Spam email using address book

[MONKEYMAN]

This morning received email from person I know but not from her email address. It had her full name in subject line and signature line. Had a link to some weight loss product Oprah has been using. Friends in her address book received same email.

Computer has Windows 7. Nod32 version 8. Browser she prefers is AOL Desktop 9.7. She started with AOL and does not want to change.

Installed malware bytes trail. Found Pup.optional.tollbarinstaller. Removed it. Nod 32 is not finding anything (in over 1 year of use).

I am at loss. I had just did all Windows,Flash, and Antivirus updates. Seems when she used computer this morning for first time is 12 days this happened.

What do I look for and how do I prevent this from happening again?

 

[jacky]

it has happened to me before my email sent out spam
it quit on its own
i used malwarebytes and panda antivirus

 

[tcp71]

sites like "linkedIn" try to access your address book. If she agreed at any time(by accident or intentionally), they download all your contacts. perhaps a site like that is sending this.

 

[The_Oil_Mole]

LinkedIn: "here, let us help you spam future employers without you knowing it"

 

[jacky]

whoever hacked mine was sending out advertisements about stereo equipment website to everyone in my hotmail address book possibly my yahoo also
no harm was done

 

[SrDriver]

I always put my email address in my address book so I get an email when something like this happens. It could be something that would infect computers for example when they open any attachment.

People think this is safe when the email comes from someone they know.

I switched from web based email to using the free Thunderbird Email Program and have not had any issues after using it.

 

[MONKEYMAN]

I found out she opened a similar email a few months ago sent from a friend that was spam. So maybe this is how it spreads.

 

[Rand]

it might not even be her. Maybe someone she sent an email too got hacked... and it was spoofing as her.

what was the full email header?(delete or censor sensitive information)

example

elivered-To: [email protected]
Received: by 10.52.153.175 with SMTP id vh15csp292629vdb;
Wed, 25 Mar 2015 18:05:52 -0700 (PDT)
X-Received: by 10.52.165.65 with SMTP id yw1mr13165076vdb.51.1427331952104;
Wed, 25 Mar 2015 18:05:52 -0700 (PDT)
Return-Path:
Received: from a13-17.smtp-out.amazonses.com (a13-17.smtp-out.amazonses.com. [54.240.13.17])
by mx.google.com with ESMTPS id v6si5453257vdi.67.2015.03.25.18.05.51
for
(version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
Wed, 25 Mar 2015 18:05:52 -0700 (PDT)
Received-SPF: pass (google.com: domain of 20150326010550e93954904bb74592bfec9d8ec10bc31c@bounces.amazon.com designates 54.240.13.17 as permitted sender) client-ip=54.240.13.17;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of 20150326010550e93954904bb74592bfec9d8ec10bc31c@bounces.amazon.com designates 54.240.13.17 as permitted sender) smtp.mail=20150326010550e93954904bb74592bfec9d8ec10bc31c@bounces.amazon.com;
dkim=pass [email protected];
dmarc=pass (p=QUARANTINE dis=NONE) header.from=amazon.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1427331951;
h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type:Feedback-ID;
bh=apsuDNEsWOLZvAyQEaKerGYhDNMm6jGhv+jkq2pbMz4=;
b=Rs5rcFWVw/8xahQKtthXD2+WIih2gSgJP+tupDvQKQjHusNVScR0xHeiJ/aBkgWm
1eITgTiFBwpZwbr0jUKVNkNbESMJAxIzMJbWjTANdYxgV65UZGWNRi7S+5h+wbak4dc
HnxRDFpYycuIpesCV0q97RTaabNdL8eOS464q0+0=
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
s=yg4mwqurec7fkhzutopddd3ytuaqrvuz; d=amazon.com; t=1427331951;
h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;
bh=apsuDNEsWOLZvAyQEaKerGYhDNMm6jGhv+jkq2pbMz4=;
b=I9SoWlji4MywyL0mJSgEH5R/7VmmwxERX77Uiyqtgs7Fg0c1Z2OelAVdZm3qxMig
8uluzKEWEYKmPCykYWxkgfoewJ0kT06H+ET0hhiVIzo71ioQiOAnl8NIRWpw8lD2TGr
0SX+7YhTh+upggYltH07ZYzdLhzdYIoRFZzXiark=
Date: Thu, 26 Mar 2015 01:05:51 +0000
From: "[email protected]"
To: ME! [email protected]

 

[MONKEYMAN]

Return-Path:
Received: from c1586n1o.securesites.net (c1586n1o.securesites.net [153.149.183.237])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by mtaig-aai01.mx.aol.com (Internet Inbound) with ESMTPS id 34D36700000B0;
Wed, 25 Mar 2015 09:42:50 -0400 (EDT)
Received: from smcc.co.jp (unknown [14.96.76.56])
by c1586n1o.securesites.net (Postfix) with ESMTPA id 4D49DE0EE4;
Wed, 25 Mar 2015 18:27:25 +0900 (JST)
X-Mailer: YahooMailIosMobile/0.0 YahooMailWebService/0.8.203.740
Message-ID:
Date: Tue, 25 Mar 2015 10:27:25 +0000
From: xxxx xxxxxxx
Subject: from: xxxxxxxxxxx
To: 21 email addresses
MIME-Version: 1.0
Content-Type: text/html; charset=us-ascii
X-VSS-HEADER: SID:141; PID:496; THREAD:139875932145408; Wed, 25 Mar 2015 18:27:37 +0900 (JST)
x-aol-global-disposition: G
Authentication-Results: mx.aol.com;
spf=pass (aol.com: the domain smcc.co.jp reports 153.149.183.237 as a permitted sender.) smtp.mailfrom=smcc.co.jp;
x-aol-sid: 3039ac1b02555512bb592380
X-AOL-IP: 153.149.183.237
X-AOL-SPF: domain : smcc.co.jp SPF : pass

Hi! How are you? Have you seen this http://aleksandrtkachenko.com/begin.php before? Oprah had been using it for over a year! xxxxxxxxxxx Sent from Yahoo Mail for iPhone

 

[dlayman]

Originally Posted By: Rand
it might not even be her. Maybe someone she sent an email too got hacked... and it was spoofing as her.

what was the full email header?(delete or censor sensitive information)

example

elivered-To: [email protected]
Received: by 10.52.153.175 with SMTP id vh15csp292629vdb;
Wed, 25 Mar 2015 18:05:52 -0700 (PDT)
X-Received: by 10.52.165.65 with SMTP id yw1mr13165076vdb.51.1427331952104;
Wed, 25 Mar 2015 18:05:52 -0700 (PDT)
Return-Path:
Received: from a13-17.smtp-out.amazonses.com (a13-17.smtp-out.amazonses.com. [54.240.13.17])
by mx.google.com with ESMTPS id v6si5453257vdi.67.2015.03.25.18.05.51
for
(version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
Wed, 25 Mar 2015 18:05:52 -0700 (PDT)
Received-SPF: pass (google.com: domain of 20150326010550e93954904bb74592bfec9d8ec10bc31c@bounces.amazon.com designates 54.240.13.17 as permitted sender) client-ip=54.240.13.17;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of 20150326010550e93954904bb74592bfec9d8ec10bc31c@bounces.amazon.com designates 54.240.13.17 as permitted sender) smtp.mail=20150326010550e93954904bb74592bfec9d8ec10bc31c@bounces.amazon.com;
dkim=pass [email protected];
dmarc=pass (p=QUARANTINE dis=NONE) header.from=amazon.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
s=ug7nbtf4gccmlpwj322ax3p6ow6yfsug; d=amazonses.com; t=1427331951;
h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type:Feedback-ID;
bh=apsuDNEsWOLZvAyQEaKerGYhDNMm6jGhv+jkq2pbMz4=;
b=Rs5rcFWVw/8xahQKtthXD2+WIih2gSgJP+tupDvQKQjHusNVScR0xHeiJ/aBkgWm
1eITgTiFBwpZwbr0jUKVNkNbESMJAxIzMJbWjTANdYxgV65UZGWNRi7S+5h+wbak4dc
HnxRDFpYycuIpesCV0q97RTaabNdL8eOS464q0+0=
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
s=yg4mwqurec7fkhzutopddd3ytuaqrvuz; d=amazon.com; t=1427331951;
h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;
bh=apsuDNEsWOLZvAyQEaKerGYhDNMm6jGhv+jkq2pbMz4=;
b=I9SoWlji4MywyL0mJSgEH5R/7VmmwxERX77Uiyqtgs7Fg0c1Z2OelAVdZm3qxMig
8uluzKEWEYKmPCykYWxkgfoewJ0kT06H+ET0hhiVIzo71ioQiOAnl8NIRWpw8lD2TGr
0SX+7YhTh+upggYltH07ZYzdLhzdYIoRFZzXiark=
Date: Thu, 26 Mar 2015 01:05:51 +0000
From: "[email protected]"
To: ME! [email protected]


I agree, sounds like a spoof.

 

[Doog]

My ISP has a spam filter that delivers all of those spoof viruses to my spam folder...I get 3-4 a day on my business account. The header line is usually "From Joe Blow" and is from someone you know....when you open it the virus writes the same message to your entire address book. I don't know what else it may drop into your system but I am sure there is something.

 

[Triple_Se7en]

How does your ISP know spoof from non-spoof?