Reply to topic  [ 5 posts ] 
Sister's Email's gone done something odd 
Author Message
What's a life?
User avatar

Joined: Thu Apr 23, 2009 7:56 pm
Posts: 12030
Reply with quote
Appears my sister's Hotmail account has either been hacked or she's got a trojan/worm-malware thing going on. She's got a load of delivery failure notices in her inbox, and I got an email that looks like this -

Image

I've had a Hotmail account since before MS took over, and I've never seen this. Any clues?
I've got her running a system scan with Avira (I think it's Avira anyway).

_________________
www.alexsmall.co.uk

Charlie Brooker wrote:
Windows works for me. But I'd never recommend it to anybody else, ever.


Wed Feb 02, 2011 7:36 pm
Profile
I haven't seen my friends in so long
User avatar

Joined: Thu Apr 23, 2009 6:58 pm
Posts: 8767
Location: behind the sofa
Reply with quote
Check the full message header - it may have been spoofed, in which case it's nothing to do with your sister and there's nothing you can do to stop it.

_________________
jonbwfc's law: "In any forum thread someone will, no matter what the subject, mention Firefly."

When you're feeling too silly for x404, youRwired.net


Wed Feb 02, 2011 7:39 pm
Profile WWW
What's a life?
User avatar

Joined: Thu Apr 23, 2009 7:56 pm
Posts: 12030
Reply with quote
Looking at the raw source -
Code:
Return-path: <sister'semailaddress@hotmail.co.uk>
Envelope-to: myemailaddress@xxxxx.com
Delivery-date: Wed, 02 Feb 2011 14:14:13 -0500
Received: from blu0-omc2-s9.blu0.hotmail.com ([65.55.111.84]:33120)
   by universe.have-host.com with esmtp (Exim 4.69)
   (envelope-from <sister'semailaddress@hotmail.co.uk>)
   id 1Pki9b-0000jn-Vo
   for myemailaddress@xxxxx.com; Wed, 02 Feb 2011 14:14:12 -0500
Received: from BLU142-W27 ([65.55.111.71]) by blu0-omc2-s9.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
    Wed, 2 Feb 2011 11:14:07 -0800
Message-ID: <BLU142-W270411EE272998126D538AE7E40@phx.gbl>
Content-Type: multipart/alternative;
   boundary="_501121e4-9128-479e-a9a6-64cabb060df6_"
X-Originating-IP: [182.177.243.185]
From: Nicole xxxxxx <xxxxxx@hotmail.co.uk>
To: <admin@xxxxx-xxxxx.uk>,
   <administration@xxxxxx.co.uk>, <admissions@xxxx.co.uk>,
   <advice@xxx.co.uk>, <agapantha1@xxxxxxx.com>, <alerts@xxxxx.com>,
   <alex@xxxxxxx.com>, <backbaydance@xxxxxxx.xxxx>, <bxxxxxxx@aol.com>,
   <xxxxxxx@dsl.pipex.com>
Subject: wg1mao gdvniuxj 43cwnw
Date: Wed, 2 Feb 2011 19:14:07 +0000
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 02 Feb 2011 19:14:07.0527 (UTC) FILETIME=[5D2AD370:01CBC30D]

--_501121e4-9128-479e-a9a6-64cabb060df6_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

http://www.better-pcb.de/images/z117.html u3pxd1s p860e e
                      =

--_501121e4-9128-479e-a9a6-64cabb060df6_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<style><!--
.hmmessage P
{
margin:0px=3B
padding:0px
}
body.hmmessage
{
font-size: 10pt=3B
font-family:Tahoma
}
--></style>
</head>
<body class=3D'hmmessage'><a href=3D'http://www.better-pcb.de/images/z117.h=
tml'>http://www.better-pcb.de/images/z117.html</a> u3pxd1s p860e e<br>           =
           </body>
</html>=

--_501121e4-9128-479e-a9a6-64cabb060df6_--


Edited some addresses for privacy, but they're all in her contacts.
Any clues?

_________________
www.alexsmall.co.uk

Charlie Brooker wrote:
Windows works for me. But I'd never recommend it to anybody else, ever.


Wed Feb 02, 2011 7:54 pm
Profile
I haven't seen my friends in so long
User avatar

Joined: Thu Apr 23, 2009 6:58 pm
Posts: 8767
Location: behind the sofa
Reply with quote
Well it was sent from Pakistan. I'm guessing that's not where your Sister is?

However, it looks like it was sent via her Hotmail so yes, she needs to change her password on that account and also anything even remotely connected to it. If that account is used for password reminders for example, then "the bad guys" will be able to reset other passwords using that...

In fact, just tell her to change every password and pin number she has. And do it now, or tomorrow her life may belong to someone else.

_________________
jonbwfc's law: "In any forum thread someone will, no matter what the subject, mention Firefly."

When you're feeling too silly for x404, youRwired.net


Wed Feb 02, 2011 9:09 pm
Profile WWW
What's a life?
User avatar

Joined: Thu Apr 23, 2009 7:56 pm
Posts: 12030
Reply with quote
Ta JJ, we reset her password almost as soon as she got the first email back.
I've also passed on the suggestion that she should be changing all her passwords - I've flushed all her browsing history, temp files etc. in IE 8 as well.

_________________
www.alexsmall.co.uk

Charlie Brooker wrote:
Windows works for me. But I'd never recommend it to anybody else, ever.


Wed Feb 02, 2011 9:11 pm
Profile
Display posts from previous:  Sort by  
Reply to topic   [ 5 posts ] 

Who is online

Users browsing this forum: No registered users and 5 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group
Designed by ST Software.