View unanswered posts | View active topics
It is currently Sat May 31, 2025 1:58 pm
|
Page 1 of 1
|
[ 5 posts ] |
|
Sister's Email's gone done something odd
Author |
Message |
ProfessorF
What's a life?
Joined: Thu Apr 23, 2009 7:56 pm Posts: 12030
|
Appears my sister's Hotmail account has either been hacked or she's got a trojan/worm-malware thing going on. She's got a load of delivery failure notices in her inbox, and I got an email that looks like this -  I've had a Hotmail account since before MS took over, and I've never seen this. Any clues? I've got her running a system scan with Avira (I think it's Avira anyway).
|
Wed Feb 02, 2011 7:36 pm |
|
 |
JJW009
I haven't seen my friends in so long
Joined: Thu Apr 23, 2009 6:58 pm Posts: 8767 Location: behind the sofa
|
Check the full message header - it may have been spoofed, in which case it's nothing to do with your sister and there's nothing you can do to stop it.
_________________jonbwfc's law: "In any forum thread someone will, no matter what the subject, mention Firefly." When you're feeling too silly for x404, youRwired.net
|
Wed Feb 02, 2011 7:39 pm |
|
 |
ProfessorF
What's a life?
Joined: Thu Apr 23, 2009 7:56 pm Posts: 12030
|

Looking at the raw source -  |  |  |  | Code: Return-path: <sister'semailaddress@hotmail.co.uk> Envelope-to: myemailaddress@xxxxx.com Delivery-date: Wed, 02 Feb 2011 14:14:13 -0500 Received: from blu0-omc2-s9.blu0.hotmail.com ([65.55.111.84]:33120) by universe.have-host.com with esmtp (Exim 4.69) (envelope-from <sister'semailaddress@hotmail.co.uk>) id 1Pki9b-0000jn-Vo for myemailaddress@xxxxx.com; Wed, 02 Feb 2011 14:14:12 -0500 Received: from BLU142-W27 ([65.55.111.71]) by blu0-omc2-s9.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675); Wed, 2 Feb 2011 11:14:07 -0800 Message-ID: <BLU142-W270411EE272998126D538AE7E40@phx.gbl> Content-Type: multipart/alternative; boundary="_501121e4-9128-479e-a9a6-64cabb060df6_" X-Originating-IP: [182.177.243.185] From: Nicole xxxxxx <xxxxxx@hotmail.co.uk> To: <admin@xxxxx-xxxxx.uk>, <administration@xxxxxx.co.uk>, <admissions@xxxx.co.uk>, <advice@xxx.co.uk>, <agapantha1@xxxxxxx.com>, <alerts@xxxxx.com>, <alex@xxxxxxx.com>, <backbaydance@xxxxxxx.xxxx>, <bxxxxxxx@aol.com>, <xxxxxxx@dsl.pipex.com> Subject: wg1mao gdvniuxj 43cwnw Date: Wed, 2 Feb 2011 19:14:07 +0000 Importance: Normal MIME-Version: 1.0 X-OriginalArrivalTime: 02 Feb 2011 19:14:07.0527 (UTC) FILETIME=[5D2AD370:01CBC30D]
--_501121e4-9128-479e-a9a6-64cabb060df6_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
http://www.better-pcb.de/images/z117.html u3pxd1s p860e e =
--_501121e4-9128-479e-a9a6-64cabb060df6_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
<html> <head> <style><!-- .hmmessage P { margin:0px=3B padding:0px } body.hmmessage { font-size: 10pt=3B font-family:Tahoma } --></style> </head> <body class=3D'hmmessage'><a href=3D'http://www.better-pcb.de/images/z117.h= tml'>http://www.better-pcb.de/images/z117.html</a> u3pxd1s p860e e<br> = </body> </html>=
--_501121e4-9128-479e-a9a6-64cabb060df6_-- |  |  |  |  |
Edited some addresses for privacy, but they're all in her contacts. Any clues?
|
Wed Feb 02, 2011 7:54 pm |
|
 |
JJW009
I haven't seen my friends in so long
Joined: Thu Apr 23, 2009 6:58 pm Posts: 8767 Location: behind the sofa
|
Well it was sent from Pakistan. I'm guessing that's not where your Sister is?
However, it looks like it was sent via her Hotmail so yes, she needs to change her password on that account and also anything even remotely connected to it. If that account is used for password reminders for example, then "the bad guys" will be able to reset other passwords using that...
In fact, just tell her to change every password and pin number she has. And do it now, or tomorrow her life may belong to someone else.
_________________jonbwfc's law: "In any forum thread someone will, no matter what the subject, mention Firefly." When you're feeling too silly for x404, youRwired.net
|
Wed Feb 02, 2011 9:09 pm |
|
 |
ProfessorF
What's a life?
Joined: Thu Apr 23, 2009 7:56 pm Posts: 12030
|
Ta JJ, we reset her password almost as soon as she got the first email back. I've also passed on the suggestion that she should be changing all her passwords - I've flushed all her browsing history, temp files etc. in IE 8 as well.
|
Wed Feb 02, 2011 9:11 pm |
|
|
|
Page 1 of 1
|
[ 5 posts ] |
|
Who is online |
Users browsing this forum: No registered users and 5 guests |
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum
|
|