Email with subject: "Re:hi ebay" (malware? virus?, what do you think?)

[luispic]

Hey everyone,

I came across with an email from my father with this subject, he certainly has no idea how that message got sent apparently from his account, nor he ever has bought or has an account on ebay, I tried googleing it but I haven't come across any good results so I thought I post it up here where the experts are

I'm supposed to go this afternoon to check out his PC to see if there is any sign of infection of some sort, and I advised him to change his password which was a very crackable one with a dictionary attack (*sigh* fathers..) so I will post any further findings later on.

Now here is the deal, on Friday some other members of my family and father's friends complained about receiving an email from him with that subject, some opened it and claim that it was a virus, some erased it, and some didn't care much, now the thing is that my father didn't (consciously) sent this email and here is a copy of the bulk message that was sent from his account:

Date: Fri, 28 Aug 2009 23:17:11 +0800
Subject: RE:hi ebay
From: <his email address>
To: <all his contacts from A to L where copied with this email, removed for private purposes>

RE:hi ebay

Dear friend:

Thanks for your reading the letter. I hope the information below will be helpful.

We are a company selling electronics ( laptops,digital cameras,LCD TV,GPS,mobile phones,mp4,game console etc.) and some Motorcycle.

We promise excellent quality and challenging price.

We did foreign trade for many years all over the world and gained certain market shares and excellent reputation.

Good quality and service with credibility can make business stand long.

Website:www.gobuyele.com #I disabled the parsing of links for security purposes

MSN: gobuyele@hotmail.com #these are both address that appear in the message

Email:gobuyele@188.com

Welcome your enquiry. Thanks

--EOF--

I couldn't get my hands on the message encoding it self since it was forwarded to me from my cousin so I couldn't check to see if it was really sent from his account or just an other server "appearing" to be gmail's

Ok so that's it, what do you people think? any ideas or knowledge in the matter?

thanks and I will post any new findings later.

 

[iisjman07]

I reckon your dad probably has a keylogger on his pc, and his info got farmed.

 

[NYJimbo]

If it's from him to a list of his email pals his PC is probably infected and a spam program just lifted his address book and sent out the emails.

Scan his PC really well, change password, etc...

 

[ITMAN]

out of interest, is your dads email @hotmail???

I sent a newsletter out yesteday and had about 10 of the same format emails auto reply (selling electricals) but ALL from hotmail accounts

Me thinks he may be infected, a change in password should help and a good scan / check

 

[Daifne]

It's also possible that he's NOT the one infected. Some of these worms will use one of the contacts as the from address and send to the rest of the address book. The machine that's actually infected could be someone who has the same or similar addresses in their address book, including your fathers. This is one reason these worms are so hard to trace.

 

[NYJimbo]

It's also possible that he's NOT the one infected. Some of these worms will use one of the contacts as the from address and send to the rest of the address book. The machine that's actually infected could be someone who has the same or similar addresses in their address book, including your fathers. This is one reason these worms are so hard to trace.

Yeah, but checking his dad's machine is the first thing to do.

 

[Daifne]

Absolutely.

Also, while he may have a keylogger as well, this activity is worm activity, not keylogger.

 

[luispic]

Hey everyone, so I have update on the issue...

I went to his office PC and found NOTHING! all I did was a little cleaning: removed a couple of programs not needed at startup and emptied temp folder, I did run diagnostic tools: avast (installed), malwarebytes anti-spyware, and did a little search with process explorer and autoruns and found nothing. Same thing goes for our home PC so I guess it most have been one of these things:

1. He checked his mail on an infected PC
2. He was a victim of a dictionary attack and the attacker managed to get his password.

or as Daifine said:
3. He's not the one infected but rather a friend of his, now the odd part is that it is HIS contacts from HIS account.

any how... my recommendation for my father was to change his password to a stronger one and maybe write it on a piece of paper so he won't forget for a couple of weeks at least, until he get's comfortable with it, same goes to all his bank transfer accounts.

I was kindda hopping I find something more useful to post but there where no other symptoms of infection.

if anyone has any other ideas they are very welcome.

btw. itman, his is a gmail account.

thanks!