Colleagues email signature is being altered on all outgoing mail from Outlook 2010 after visiting Hilton Hotel

A colleague of mine was at a Hilton in the US (we're in Canada), and now every time he sends an email to someone from Outlook 2010, there is some garbage appended to the end of his signature... The kicker is, if he sends an email to himself, it doesn't append anything to the signature.

We've checked proxy settings, and checked the signature files themselves to see if they were altered. No such luck. We're running some virus/malware scans now but has anyone seen this or have any idea how they would be altering outgoing mail like that?

It made more sense that his signatures would be altered while he was on the hotel wifi, but now that he's back, I cannot figure out why it is happening.

Edit: To clarify, it is appending a bunch of information about the hotel to the bottom of the signature. Address, contact information, how to connect to the WiFi, there's also several pictures it is linking to.

pay

Posted 2017-05-29T14:28:23.330

Reputation: 254

So he/you can't see the appended information while composing the email? It only appears once it's been sent? Is it spam type information, or literal 'garbage' ? – djsmiley2k TMW – 2017-05-29T14:30:19.120

It is a whole bunch of information on the hotel. The address of the hotel, contact information, how to connect to wifi, and there's a broken picture link as well. – pay – 2017-05-29T14:36:27.650

And that's appearing from a location completely unrelated to the hotel? Wow... that's... odd :/ – djsmiley2k TMW – 2017-05-29T14:44:26.903

Yes, extremely strange... He's now back in another country, on our internal internet connection (although we have him on a connection that does not have access to our primary network for now) and it is still doing it – pay – 2017-05-29T14:45:07.037

He could try "system restore" or uninstall and reinstall outlook. Did he check all the network settings? IP/DNS address, proxy server, etc? Maybe his computer is set to use the mail proxy server of the hotel. – SpiderPig – 2017-05-29T14:47:08.330

Yes we checked proxy settings in browsers, on the network interface, and in Outlook. They all appear to be normal. DNS settings are also normal – pay – 2017-05-29T14:48:20.987

2I've stayed in Hiltons all over the US and never had hotel wifi append to emails. (I'd, in fact, stay elsewhere if it did that). I suspect masquerading malware. – Tyson – 2017-05-29T14:50:42.707

I would contact the hotel, they should be aware of this and I think their reputation is more imperative for them then some unwanted link. – Máté Juhász – 2017-05-29T14:51:31.543

You could use Wireshark to monitor his network traffic while he sends a mail. – SpiderPig – 2017-05-29T14:53:42.440

Can you (or your network admin) have a look at the mailserver to see where the email is coming from - it should be coming directly from his laptop, but it sounds like it's routing via something else. If it's coming directly from the laptop, with this information appended then it's definitely malware on the laptop itself. If it's going via somewhere external, it still could be a outlook setting... – djsmiley2k TMW – 2017-05-29T14:56:42.540

We will be contacting the hotel's corporate office regarding this. We may wireshark the traffic as well, but for now I just noticed there is a strange URL in the email signature that includes something about Avast Antivirus and a 'tunnel ID'. Unfortunately we use Avast here... Which ironically might be the root of the issue. – pay – 2017-05-29T15:02:34.823

I guarantee it is. Disable the Avast outlook plugin to confirm. You should also contacted your system administrator so they can reimage the system – Ramhound – 2017-05-29T15:47:49.793

Ya, it was the Avast signature. Our IT admin is going to do a thorough checking of the system and likely re-image it tonight as well. – pay – 2017-05-29T16:01:56.887

Answers

We figured it out...

They somehow altered the default Avast email signature (the one that says 'This email was scanned by Avast etc.). When we disable the Email Signature option in Avast, we no longer see the Hilton information appended to the email.

As far as how they altered it, I do not know yet. We will continue to investigate for malware/viruses.

Edit: Upon searching for this issue I am really not finding anything or anyone talking about it... Perhaps we should alert Avast as well

pay

Posted 2017-05-29T14:28:23.330

Reputation: 254

Does avast have any options for peer-to-peer definitions files, or is it configured to point to a management server? that it reconfigured avast, kind of implies that the program asked for information (configuration) and got a response from an undesirable source, like a management server on the hotel's network. Avast was installed on the laptop before the employee went into the field, correct? – Frank Thomas – 2017-05-29T17:05:38.910

Yes Avast was installed and as far as I understand when we install Avast, it has to communicate with something on our network to retrieve license information. As far as contacting some server thereafter, I'm not entirely sure. We'll take a look at the Avast settings but I suspect whatever happened is airing on the side of malicious. I can't see the Hilton purposely doing that kind of thing, but maybe... – pay – 2017-05-29T17:25:35.383

We had a similar issue recently, it turned out that AVG antivirus had somehow got its email signature message changed to the hotel's message and kept sending that out with all emails sent out from outlook.

The solution was to uninstall AVG and put another antivirus on.

Mun Rassul

Posted 2017-05-29T14:28:23.330

Reputation: 11

Did he make any configuration changes so that he could send email out while staying at the hotel? I used to work for a company that managed those networks. Some guests would need to modify their SMTP server to send mail out. I would check there first. If that doesn't fix the issue, try recreating his Outlook profile and test with that next.

Is there also a possibility of testing his account through OWA or is this account not Exchange based?

Sorean

Posted 2017-05-29T14:28:23.330

Reputation: 668

No, our Outlook is configured to use our email providers servers. He didn't change anything himself. We have checked his outgoing mail servers and they all appear unaltered. – pay – 2017-05-29T15:16:34.593