Virus email - advice required.

[So]

I have just clicked on links in an email sent to me from my sister in law's email address. Which turned out not to be from her.

I am normally pretty savvy about these things, but this one addressed me by name and was signed by her!

The links appeared to be to Bing search pages and one page for a web host (I think) that was not operative.

I called her to find out what message she was trying to communicate, and she said she hadn't sent them. I presume therefore she has been hacked.

I have run Malwarebytes and nothing was found. I am guessing that as the links were to Bing I am probably OK. But advice would be appreciated please.

[bitchstewie]

Difficult to be 100% sure on either count as you're not 100% sure where the page took you (you think Bing but don't sound 100% sure it was only to Bing) and your sister may have been hacked or it could be someone spoofed her email address having got it from elsewhere.

My advice is always start with the basics on your (sisters and your own) email account:

• Use a good provider (Gmail is my suggestion)
• Choose a strong unique password
• Enable 2 Factor Authentication

That will put you in a decent position, next:

• Get a password manager
• Make sure you're using strong unique passwords everywhere
• Use Chrome with something like the uBlock Origin plug-in
• Keep your PC and all applications updated, ideally set it to do it automatically so you don't have to think/remember to do so.

[So]

bhstewie said:

Difficult to be 100% sure on either count as you're not 100% sure where the page took you (you think Bing but don't sound 100% sure it was only to Bing) and your sister may have been hacked or it could be someone spoofed her email address having got it from elsewhere.

My advice is always start with the basics on your (sisters and your own) email account:

• Use a good provider (Gmail is my suggestion)
• Choose a strong unique password
• Enable 2 Factor Authentication

That will put you in a decent position, next:

• Get a password manager
• Make sure you're using strong unique passwords everywhere
• Use Chrome with something like the uBlock Origin plug-in
• Keep your PC and all applications updated, ideally set it to do it automatically so you don't have to think/remember to do so.

Thank you.

I am pretty sure that one link was Bing and the other not working.

It was the cleverest one I've had to date. It was:

"Hi My Name

Link
Link

Love Claire"

[bitchstewie]

I would be ensuring she checks her email account.

People tend to use bad passwords or re-use passwords across websites

So for example someone hacks a website and finds that yoursister@yahoo registered with a password of Password123 (people still do this ).

They now go to Yahoo and try to login as yoursister@yahoo with a password of Password123 and as so many people use the same password everywhere....

[The_Jackal]

This is why advice has always been, question first, click later.
Now you really are savvy.

[jesusbuiltmycar]

Was the URL that you went to actually bing or was it another site made to look like bing?

[So]

The_Jackal said:

This is why advice has always been, question first, click later.
Now you really are savvy.

Yes it is. And I've been receiving dodgy emails for the thick end of 20 years. There was nothing about this email to indicate it was anything other than genuine. Other than the links led nowhere interesting.

[driver67]

So said:

Yes it is. And I've been receiving dodgy emails for the thick end of 20 years. There was nothing about this email to indicate it was anything other than genuine. Other than the links led nowhere interesting.

The links didn't have to be interesting, you clicked them which is what the spammer wanted.

The web page you landed on could have hidden code exploiting any vulnerabilities in whichever web browser you were using.

e.g. unpatch windows XP internet explorer

[So]

driver67 said:

So said:

Yes it is. And I've been receiving dodgy emails for the thick end of 20 years. There was nothing about this email to indicate it was anything other than genuine. Other than the links led nowhere interesting.

The links didn't have to be interesting, you clicked them which is what the spammer wanted.

The web page you landed on could have hidden code exploiting any vulnerabilities in whichever web browser you were using.

e.g. unpatch windows XP internet explorer

Yes I understand that. I was responding to the point about not clicking on links in emails.

I never click on links in emails, unless I know the sender, am expecting to hear from them and there are indicators in the email to suggest that the email is genuine.

It's the first time in 20 years that I have received a fake email with the correct sender's email, my name at the top of the body of the mail and the right person's signature.

Has anyone else ever received an email like this?

[Australiam]

Some good advice so far. However, as well as taking those steps yourself, make sure your sister does the same. Assuming she has some malware on her machine, it could be harvesting passwords. So she should takes steps to be confident she cleans her machine, then updates all passwords following the guidance listed earlier in this thread.

I would also suggest you (and she) scan the machine using a 2nd AV, just in case Malwarebytes, or any other missed something. I am an advocate of Sophos, and their home product is free. There are others available. Lastly, as you have not found anything, you could also run a tool to look for rootkits. The Sophos removal tool does this, and again is free for home use.

https://www.sophos.com/zh-tw/products/free-tools/s...

[Donbot]

So said:

It's the first time in 20 years that I have received a fake email with the correct sender's email, my name at the top of the body of the mail and the right person's signature.

Has anyone else ever received an email like this?

Email address spoofing is easy to do, and has become quite popular for the scammers.

I recently received an email from myself (to make it look like my account had been hacked) blackmailing me for bitcoin.

Edit. Not the same as what you had, but some of the scams are becoming very convincing.

[HM-2]

MalwareBytes is pretty much the worst performing antimalware product on the market. That said, clicking a weblink is seldom enough to get you infected with anything these days; most nastiness requires some kind of active user input unless you've not patched IE for a year.

Many commodity malware families have modules that let them send email spam from infected victims to their contacts- usually to infect more people. Thus may or may not include things like the actual victims signature.

Edited by HM-2 on Saturday 9th February 18:14

[omniflow]

Where did the email actually come from - check the headers.

It's highly likely it didn't come from your sister at all, and her PC / email account is completely innocent in all of this.