Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: MrToad on April 18, 2014, 03:31:05 PM

Title: Email bot attack Links to malware sites in email
Post by: MrToad on April 18, 2014, 03:31:05 PM

A friend was infected/recruited into a bot-net which resulted in multiple emails with links to malware attack sites. Since Avast screens email and clearly has capability to detect and alert users of malware links in the browser [avast online security add-on], I'm wondering if there's a way that it can check for links to attack sites in emails.
Being the paranoid sort, I currently check most links with online link scanner before opening...which is how I determined my friend's email had be hijacked into a bot-net. This is a cumbersome process and I would like to tell others if there's a way to do this automatically, since I have several friends who are more trusting than I am.
I use Thunderbird and would be open to non-avast related strategies to automatically check emailed links.
Thanks for comments & suggestions.

Title: Re: Email bot attack Links to malware sites in email
Post by: Pondus on April 18, 2014, 04:02:24 PM

You can check links (one by one...sorry) against reputation lists here

www.urlvoid.com
www.virustotal.com    (Here you can also check files for infections)

Title: Re: Email bot attack Links to malware sites in email
Post by: Para-Noid on April 18, 2014, 04:02:54 PM

The avast mail shield is for certain email clients like Thunderbird and Outlook. If a user is using a
web based email client like Gmail or Yahoo or outlook(dot)com then the web shield does the scanning.
The best policy is "to look before you leap". I would advise your friend to "not" click on just any link in
an email especially if the email is in the spam folder. You may also suggest your friend install the "virustotal"
extension in each of their browsers. Don't forget to teach them on how to use virustotal. virustotal is not
the definitive scanner to use however it does give you a reasonable idea of a sites safety. Another idea is to
install the various link scanners available through most browsers.  :)

Title: Re: Email bot attack Links to malware sites in email
Post by: MrToad on April 18, 2014, 04:29:48 PM

I found Dr. Web Link checker https://addons.mozilla.org/en-us/thunderbird/addon/drweb-anti-virus-link-checker/ is an add-on that will check emailed links. When I checked a few of the links in my friends bot-net hijacked emails, they tested OK...also tested OK in online link scanner....Since my friend had acknowledged the email hack and the emails are clearly from a bot-net,  I find  this a bit curious...troubling, if link scanners can't detect attack links.

Title: Re: Email bot attack Links to malware sites in email
Post by: Para-Noid on April 18, 2014, 05:06:11 PM

Link scanners can only do so much. If you want to do in-depth analysis there are more complex scanners.
Please keep in mind "no" scanner has a 100% detection. There will always be anomalies.