Ask MetaFilter questions tagged with virii

Someone is spamming from my gmail account.

roofus — Sun, 11 Jan 2009 23:08:11 -0800

Has my gmail account really been compromised? Someone, or something seems to have spammed my entire contacts list, from within my gmail account, despite my having a strong password. (Same problem described by this german gmail user).

Has someone really stolen or guessed my password, and do I need to take anti-virus precautions beside changing my password? I am running OS X 10.4.11.

The previous activity on my gmail account suggests someone was using it elsewhere at the time the emails went out, in a GMT+8 timezone:

Browser 115.49.96.23 5:28 am (1 hour ago)

The text of the email and the header (minus 500 email addresses) are below:

---
Dear,
Good day!!!
I would like to introduce a very good company, electronic products
Wholesale dealer.
I have bought some products from company,the price was very cheap,
and the products are very good quality!
Just have a look at this web page : http://www.hpp[redacted].com/
I am sure you will could save a lot of money!
Happy new year!!!!!
Best regards!!!
introduction give you of friend!!!
---

This is the header:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=domainkey-signature:received:received:message-id:date:from:to
:subject:mime-version:content-type;
bh=K6tVhE5iH9jG8/7W3sL3UlYq6awTl26w2OX6rEz6znw=;
b=aEmoNLBhwOJd78gsKoXBSfQU7ZrUJ5yW9TwQe4BS9Z95uMciQgV0xulNnSwsF78wrz
K5BSCZPAJSWwTatBtW+N3lrFHYGRYnJxBXIY2n27cuFJf+C4pZk51F7oJwQUqQDwFzHT
uZqHFcLFBsyEYbK9C3ovp4b/IPtr8ra+Qq618=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
h=message-id:date:from:to:subject:mime-version:content-type;
b=qtqP0ZUW3LzE837BnVjmCGEIxXrpddkhrjWNDruuZm4M372ePF8bBfUUq+/qvzKgdQ
xvqRgGgOLp9VAxhgPbhVNnAAA/thhEqJtw09/A61L0gREHySwCvINze1Yfi7sY6DEZKM
ewL1U02Pwa/pHMmAUIpFgrJMxEiKi2PrjIa4o=
Received: by 10.215.100.13 with SMTP id c13mr4320711qam.377.1231738078819;
Sun, 11 Jan 2009 21:27:58 -0800 (PST)
Received: by 10.214.43.15 with HTTP; Sun, 11 Jan 2009 21:27:58 -0800 (PST)
Message-ID:
Date: Mon, 12 Jan 2009 13:27:58 +0800

Adware everywhere

Venadium — Wed, 07 Feb 2007 13:53:51 -0800

Please help me get rid of this spyware infection before I just give up and re-install Windows. My PC is infected with what seems like at least 2 or 3 different varieties of spyware/adware/malware. This started happening a day or two ago after someone else in the house fell for a MySpace bulletin posted under someone else's phished/hacked account. I hardly ever actually use my PC so I didn't notice until this morning.

I've got a small blinking icon in my taskbar that alternates between an X in a circle and then a question mark. It pops up little messages about "Critical System Errors!". From what I understand, this is a malware program named VirusBurst.

The most noticeable problem though is whatever that's installed on here and is opening Firefox windows to various ads and webpages. It happens in bursts, up to 4 or 5 popups at a time, and seems to happen randomly. While typing this, it's only happened once, but in the time it took to get over to AskMefi it happened 2 or 3 times.

The worst part of all of this is that there seems to be yet another malware program that closes Lavasofts Ad-Aware or SpyBoy S&D before they even start. It will also close any browser window that I use to try to search for Ad-Aware or any other spyware removal tools. This is supposed to be something called CoolWebSearch, but every tool I try which is supposed to remove CoolWebSearch claims that it can't find it on my system.

So what can I do, other than giving up and reinstalling Windows (along with all the software and games that are currently installed)? I can post a HijackThis log if anyone asks for it.

Aurora: not the pretty lights in the sky.

moonbird — Mon, 16 May 2005 20:27:03 -0800

Two friends have been infected with the evil Aurora pop-up thing, and I've spent hours thinking about how to kill it. I've installed Avast on their systems and no dice yet. Is there an app that will destroy it, or is the fix deep DIY registry surgery? Thanks!

How do I tell what program inserted a registry entry?

twine42 — Sun, 18 Jul 2004 07:05:52 -0800

PCFilter : Is there any way to tell what program inserted something into the registry?
I've been attacked by four seperate virii that sophos claims don't exist in the wild. One of them (netclnc.exe) keeps reappearing in my registry and the system32, and I want to know what's putting it there so I can kill it. Ideas?