My email clients and computer have been hacked

Question

My client system has been compromised and hacked.

My client is using wWindows 7 and Outlook Express 2007 for email communication.

The Email ID of my client is from a Yahoo Small Business account.

My client is using licenced antivirus from QuickHeal Total security.

Now my clients email is, say johndoe@clientsdomain.com and buyers email say abcd@buyersdomain.com.

Now, the hacker has created 2 separate email IDs:

Johndoeclientsdomain@hotmail.com
abcdbuyersdomain@hotmail.com

every email getting passed from both sides goes to hacker then hackers feels the email should not be stopped passed to client and his buyers from above 2 email addresses.

These fake emails pop up in "reply email" when my client or his buyer clicks "reply" for email in Outlook Express. Since the IDs looks so similar and because of regular communication, the hacker took advantage of this.

This happend with my clients and his 4 buyers and the hacker took advantage of this and got funds transferred to his UK accounts by modifying the communication in between.

Please suggest what can be done to secure system and get rid of this problem permanently and how to trace where the whole system has been compromised.

Answer 1

Uninstall 'QuickHeal Total Security' and get a decent, recognised Anti-Virus scanner installed! Something like AVG Free or Microsoft Security Essentials are free to use and much more recognised/reliable/known than something like QuickHeal.

It would be also worth running a complete malware scan on the system, with something like Malwarebytes.

Once the system is free from anything suspicious then you should work through the settings in the Mail program to verify all are correct. You shouldn't be using 'Outlook Express' in Windows 7, use Outlook or Windows Mail.

Answer 2

Sounds like some trojan. At least you have to scan the system from some clean disk, better reinstall windows. Make sure to update windows completely and install a running anti-virus software before playing back any data.

Chance of infection can only be minimized by regularly updating your system and other software and installing an anti-virus-program (which also must be updating regularly). Obviously your client had an anti-virus program though I didn't know about this one before.