Malware.

[Avenue]

A friend was telling me today he bought something on paypal as a once off payment so he had to enter his credit card info. A few minutes after he paid, 3000 was billed to his card from a online cell store in the USA.

I would like to help him, but I don't know much about windows security.

So I checked the link and he was directed to the genuine paypal site.
He runs Nod32 Antivirus Windows 7 and chrome browser. (not sure if everything is up to date.)

There is a security hole somewhere, so what should he do to diagnose and remove whatever this is. since NOD doesn't seem to pick up anything.
And what should he then do to beef up security in the future.
I remember on XP, autoplay was a problem when using USB drives, is this still an issue?

 

[GoofySmurf]

A friend was telling me today he bought something on paypal as a once off payment so he had to enter his credit card info. A few minutes after he paid, 3000 was billed to his card from a online cell store in the USA.

I would like to help him, but I don't know much about windows security.

So I checked the link and he was directed to the genuine paypal site.
He runs Nod32 Antivirus Windows 7 and chrome browser. (not sure if everything is up to date.)

There is a security hole somewhere, so what should he do to diagnose and remove whatever this is. since NOD doesn't seem to pick up anything.
And what should he then do to beef up security in the future.
I remember on XP, autoplay was a problem when using USB drives, is this still an issue?

Yes there is a patch that disabled auto-run due to the conflicker virus. The only advice I can give your friend is not to be so trigger happy.

 

[Praeses]

On Win7 I don't think autoplay is as big an issue as it was on XP.

I suggest running a Malwarebytes Anti-malware ( http://downloads.malwarebytes.org/mbam-download.php ) as well as Anti-rootkit ( http://downloads.malwarebytes.org/file/mbar ) scan.
Could be a keylogger hidden somewhere.

Was the paypal site using HTTPS or HTTP?

What was the amount he was supposed to pay and in which currency?

 

[Avenue]

On Win7 I don't think autoplay is as big an issue as it was on XP.

I suggest running a Malwarebytes Anti-malware ( http://downloads.malwarebytes.org/mbam-download.php ) as well as Anti-rootkit ( http://downloads.malwarebytes.org/file/mbar ) scan.
Could be a keylogger hidden somewhere.

Was the paypal site using HTTPS or HTTP?

What was the amount he was supposed to pay and in which currency?

Cool- thanks.
It's Https
and about 11 GBP

 

[Avenue]

Yes there is a patch that disabled auto-run due to the conflicker virus. The only advice I can give your friend is not to be so trigger happy.

Yeah I still use XP for game and run a file to block autorun in the registry every time I reinstall windows- one of the first things I do.

 

[KleinBoontjie]

Where did he enter his credit card info? Paypal or online shopping site? If his Paypal is setup correctly, then I'm thinking he doesn't need to enter it again when buying something. He just need to log into Paypal at Checkout and confirm. I may be wrong, been some time since I bought something online.

 

[Avenue]

Where did he enter his credit card info? Paypal or online shopping site? If his Paypal is setup correctly, then I'm thinking he doesn't need to enter it again when buying something. He just need to log into Paypal at Checkout and confirm. I may be wrong, been some time since I bought something online.

He doesn't have a paypal account. Apparently they offer one time payments though, so you dont have to go through the entire process. Never heard of this so I went to the site and did a dummy transaction, and it linked properly to paypal- https and the extensive verification in the address.

 

[InvisibleJim]

Your friend can report unauthorised transactions or spoof Paypal sites to Paypal.

https://www.paypal.com/us/webapps/mpp/security/report-problem

Not sure how far they go to protect people paying via credit card as opposed to Paypal account but I think it would be worth reporting to them.