Post by: Dick Miller on July 02, 2010, 06:45:41 PM
Post by: kbeartx on July 02, 2010, 09:43:05 PM
Kb
Post by: Dick Miller on July 02, 2010, 10:02:23 PM
Post by: Xairbusdriver on July 02, 2010, 10:10:37 PM
Just because someone gets a message that has your "From:" address on them means next to nothing. Any of your PC buddies could much more easily have this kind of virus, using their address book and putting your address in the "From:" box. Of course, only those who really know you would tell you that they are getting stuff from "you."
As a matter of fact, I suspect the "bagel" came from the same computer that is actually sending these messages. But, just because ClamX finds it, doesn't mean it would even run on your Mac, unless, of course, you are also running Windows.
As far as I can tell, it's a Windows worm. No problem. Except that if it was in a message that you forwarded, their Windows machine could get infected. So far, the only reason to scan email messages, at least those that you forward, is to remove any worms/virus that might be in them. And that's just to be kind to our Windows brethren. 
Just a few weeks ago, I had Comcast tell me that I had exceeded my quota of sent messages in a 24 hour period. I didn't bother asking them to prove it since I never even use their smtp server, nor even their POP one. I simply deleted the Comcast account from Mail and no longer had to see the "!" indicating that they had cut me off temporarily. The hoops needed to jump through to convince them that they didn't come from me would be a waste of time since I wouldn't gain anything from the exercise.
Perhaps I should contact them and see if I'm still cluttering up their server? Maybe next month...
Post by: Dick Miller on July 03, 2010, 12:53:09 PM
Post by: Xairbusdriver on July 03, 2010, 09:11:22 PM
QUOTE
Ok how did it get all the address from my address book ?
Are you sure that all those people got messages? Or just those who are mutual friends of someone in your list.I'm betting that the only addresses that were in your address book that got these messages are the ones that were also in the address book of the friend who has the worm. The mutual friends who told you they got the messages think they came from you because your name is in the "From:" section. As far as I know, there is no known worm, in the wild, that will operate on the Mac OS. However, there are known trojans. But, all bets are off, if you download and install one of those.
Of course, if you are also running Windows (dual boot) that OS can be infected, just like any other Windows machine. The good part, is that even if that partition is infected, it still won't bother your Mac area.
Post by: Dick Miller on July 03, 2010, 09:55:38 PM
Post by: krissel on July 04, 2010, 02:38:43 AM
Could the worm have infected the Yahoo account's server and is thereby using the addresses it finds there?
Post by: Dick Miller on July 04, 2010, 09:28:36 AM
Post by: Xairbusdriver on July 04, 2010, 04:48:28 PM
QUOTE
Thunderbird. It's AT&T Yahoo mail.
Oops! 
I completely missed that. So, it's not the address book that is on your Mac. It's the one on the Yahoo server. Never kept an address book off my local drive...no control and all that...same reason I don't store my important files on-line! At any rate, there's definitely no worm 'burrowing' on your Mac.BTW, by not downloading your messages, they are still on the server at Yahoo. That can be handy if you travel with one computer and normally use another at home. OTOH, you may actually be downloading your messages and have set up Thunderbird to delete them in a certain amount of time.
IMAP stands for Internet Multiple Access Protocol. No, wait...it's Interesting Mail Accumulation Process. NOT! 
I really don't even care enough to look it up! While I have one IMAP account (mac.com) I use their POP server and when I read a message on my iMac, but the IMAP server when I access it from the iPhone. The advantage is you don't have to worry about your mail box filling up and not getting messages because of that. Of course, that's not much of an advantage now with most ISPs offering ever more space.
<IMAP>
Post by: Paddy on July 04, 2010, 11:09:55 PM
http://www.sophos.com/security/analyses/vi.../w32bagleo.html (click on the "more information" tab)
There are many, many variants of this particular worm - it's been around for at least 7 years now.
What exactly makes you think that you are the source of the emails and how many of your friends have received them? Typically, these worms spoof the "from" address - they aren't actually sent from your computer, but from the computer of someone you know who has you in their address book. If you've sent an email to a whole bunch of people that you know, then one of them may be infected; the worm just picked up all the addresses from the email you sent. It doesn't just use email address books, but scans the drive.
I would be very surprised if Yahoo is somehow infected - they would have good anti-virus software in place and this isn't a new worm by any means.
Post by: tacit on July 05, 2010, 02:38:45 AM
However, your email has been compromised, but not by a computer virus.
Eastern European hackers have been attacking Yahoo, Hotmail, AOL, and other free email services. They aren't using a virus; the attack is much simpler than that. They run a program that tries to guess your email password.
If oyu do not use a secure, strong email password, eventually the program will be able to guess it. Once it guesses your email password, the hackers have access to your address book that is on the email server, and they use your hacked email account to send spam to all the people in your email address book.
The way to avoid this problem is to use a strong email password. Now that you have been hacked, it is important that you change your email password immediately. Use a strong password that has upper and lowercase letters and numbers; never use a simple word that is in the dictionary for an email password.
Post by: Dick Miller on July 05, 2010, 09:27:04 AM
Post by: Paddy on July 05, 2010, 10:42:04 AM
Post by: kimmer on July 05, 2010, 01:32:08 PM
