Virus Email

[stayouttadabunker]

HEY bunker i got one to about 5:27 . got a mac so i think I'm OK . deleted email  no hard feelings sh--t happens

Thanks plunger!
Sorry somebody sent you that!
I noticed they all have different php links.

It's definitely the work of some ad agency someplace....

[shortrackskater]

Don't let it beat you up Mark, could happen to any of us and those that get mad about it can go piss up a rope. Not like you did it yourself or on purpose. Pardon my language, but fuck'em if they don't understand you got attacked

I completely agree! If anyone is that STUPID to think you sent that, they can go uh...do what's quoted above!  
It takes about one iota of common sense to figure out your e mail was compromised.  
Sorry to hear that happened to you!!

[Foster]

I had something like this happen to me from my yahoo e-mail

I wish I could tell if it was something that got put on a persons computer that waits until it detects the user being idle or AFK and then sends out the e-mail or a script that loads when some sites are visited and if it finds that user logged into hotmail,yahoo, gmail, or even ISP web based e-mail account does its dirty work.

[CaptainHappy]

I just had a little panic of the timing of my email from Bunker thinking I got mine alot earlier than everyone else, 4/27/2012 2:27:15 PM
Then I pulled my head out of somewhere pretty dark, and realized mine is PST, which is 5:27 EST...

FWIW, mine was a text email with the following in it which was not clickable as an active link, maybe the computer protected me from that? If I just moused over it it was just an I bar, not a clicky cursor. Also the below is just a copy of what was in the text without the "dot php" at the end of it.

h t t p : / / whyzine.com / images / mvsd55x2 EDIT I ADDED SPACES AS THE FORUM SW SAW IT AS A LINK FIRST TIME!
4/27/2012 2:27:15 PM

CH

P.S. FOSTER, what is AFK??? Away From Komputer??  

[FORDSBS]

Bunker, I'm insulted, I didn't get one.   
Good luck getting all taken care of.
Ford

[slotsteve]

Bunker, I'm insulted, I didn't get one.   
Good luck getting all taken care of.
Ford

Thats ok you can have ours  i only opened the email  , Am i safe?

[FORDSBS]

If you didn't open link you should be OK

[slotsteve]

nope I didn,t this time 

[JOHN42355]

Mark ,OMG I was wondering what that email was about. I did receive it Also... John

[stayouttadabunker]

I'm so sorry capt happy, shorttrackskater, steve, westec1, john...everybody!  
I think it went to everybody on my email!
So far, I've found that it sent out about 87 emails! arghh!
I still may get reponses from about a 150 more people!  

I didn't send it and DONT open the link!

Thanks!

ps
what time did you get yours?
Everybody is reporting it started at about 5:26 or 5:27 yesterday.
I've completely cleaned out my computer with a Malwarebytes full scan and 3 infections were found last might.
They were from 2 ad companies....you can see it in the screenshot in Reply #19...


That hotmail account is okay now but I had 253 contacts on it
and everyone of them got an email with some sort of a PHP link....DONT OPEN THE LINK! PLEASE!

[JOHN42355]

The time on My email , was 4/27/20012 5:26 PM
I fixed the Time I received that email

[stayouttadabunker]

That's strange....since when you live in California john? 

[JOHN42355]

OPPS , I meant 5:26 , sorry was looking at another email!!! Want me to forward that over to you? I seen the email , but didn't click on anything... Thank GOD

[stayouttadabunker]

no...just delete it but if you can...delete it with the message drop down dialog box that says "My friend's mail was hijacked!"
or something to that effect.
That way Hotmail knows it wasn't from me actually.
Not every email company has that option so just plain deleting it will be okay I think.
I had to remove everyone's email from my Hotmail account
and saved them in a separate Wordpad for now until it's all straightened out at Hotmail...argh!
 

[uniman]

I got one too. Obvious it was a hijack spam or virus/worm.
Logged on to NLG and found this post.
Thanks for posting! Just verified what I suspected.
Not the first time this has happened, won't be the last.

Jim

[stayouttadabunker]

I'm glad you didn't click on the link Uniman! 
Ohhh!...the internet world we live in....argh!

If anybody clicked on the stupid PHP link they put in there...go to malwarebytes.org
and get the cleaner recommended by Jay.
My computer is working great now! whew!
It took about 5 minutes on the quick scan to get it out.
Only problem now is some bloody advertisement company has everybody's email addresses now....
I think whoever did that should be thrown into jail!

Below is what my computer looks like now after performing the malwarebytes scan for the second time...>>>

[Magicslots]

Mark, I am sure you know, but i got it too, actually for quite a while now I have gotten emails from you at random that say you have sent me some pictures...
I never opened them , since you had not told me you were sending any...   Its a common "virus"  goes around a lot on the net!

PM me your new email, when you can..

[staz]

i got it too im glad i opened it on my cell it wouldnt let me click the link i just deleted it....

[Neonkiss]

I hate to admit it, but I got it and clicked on the link yesterday.
It started to load with a green progress bar and I knew something was wrong.
I closed the page quickly. Checked and it looks like my anti-virus software did it's job.
Checked and did scans with the anti-virus and Malware and nothing showed up.

Good thing because I just got this computer. Good news I haven't loaded any of my address book yet, so they didn't get any info from me.

[tjkeller]

Been off here for a while and just now saw this thread.

Bunker...This is a Hijack...not a Virus.

To stop this do as cowboygames said and Change your Passwords.
I too have suffered a hijack and know the frustration you are going through.

FACEBOOK is riddled with these attacks. That was the source of my hijack.
You have to be VERY careful of any links/posts you click on there. They are
disguised as some really interesting story to entice you click on them. When
you do, they extract your saved passwords on your pc...specifically targeting
email so they can mass spam out their crap. It is Not Hotmail's fault and you
will be able to continue to use your Hotmail acct after you change your password.
Problem is the "damage" has already been done but anyone who knows you
should realize you did not send this on purpose.

Malwarebytes is an excellent program to help keep your PC safe but you really
need to take more measures for a deeper level of safety. In the world of freeware
I use Malwarebytes, CCleaner, Spybot, & AML Registry Cleaner. I've found that
no one program does it all. What one misses the other catches. Mbam & Spybot
are good malware cleaners and CCleaner & AML are good registry cleaners.
A lot of people don't realize that if you must keep your registry clean. You can
run a program to clear malware & viruses but if you don't clean the registry they
can sometimes come back. (cleaning your registry also boosts PC speed by getting
rid of crap that ties up resources)

Its a good idea to run these programs periodically to keep your pc clean/safe.
I would advise that anytime you run a registry cleaner ALWAYS back-up the
registry 1st cause sometimes they erase too much and can stop your pc from
running. Most programs such as the two I mentioned ask you if you want to
back-up the registry and will do it automatically when you select yes.

When searching for software, BE AWARE OF IMPOSTERS!!! There are many
that display the Windows insignia are the AVG insignia that are NASTY, NASTY
bastards that take over your computer. NEVER ever do any free online
computer checks no matter who they claim to be. Stick with your known &
trusted programs.

To that end, here are links to the programs I mentioned:

CCleaner:  http://www.piriform.com/ccleaner
AML Registry Cleaner:  http://www.amltools.com/
Malwarebytes:  http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html
Spybot:  http://www.safer-networking.org/en/mirrors/index.html

These are all Freeware so no charge. If you like them you can donate or upgrade.
If using Spybot, I recommend NOT activating "teatimer" cause it really slows your
PC down but it is a 'running' program to keep you safe. I've had no issues without
it being active. Just remember to run these programs every once in awhile to keep
your PC clean and to keep the program updated.

ALL THE BEST!

tjkeller 
  Docs

[cowboygames]

I use a subscription registry cleaner called ARO and run it once a week. Anybody ever heard of it or have any comments on it? It backs up my registry before it starts it's clean each time

[Magicslots]

Hey tjkeller
Glad to see you back...I have a minor bug called the Search123 "virus"
sometimes redirects your home page, but mainly just sends a crap load of unwanted popups that I never click on..
I am running Zone Alrm extreme, crapclearner, and malwarebytes, but these wont find and fix it..

Suggestions?

[poppo]

When I got it, I pretty much knew it was not legit based on it just being a link and multiple recipients. 

Most of the times when people get e-mails like that, they are not even coming from the person it looks like it came from. Someone else's computer has a virus and is sending them out with a spoofed "from" address. Very hard to figure out who's computer is actually sending it.

[proten]

One program I use to find this crap
 is "Supper AntiSpyware".
You can get it at supperantispyware.com
and it's a free program.

[tjkeller]

Hey tjkeller
Glad to see you back...I have a minor bug called the Search123 "virus"
sometimes redirects your home page, but mainly just sends a crap load of unwanted popups that I never click on..
I am running Zone Alrm extreme, crapclearner, and malwarebytes, but these wont find and fix it..

Suggestions?

Looks like you will have to do some registry editing:
see:
http://www.removemalwarespyware.com/cant-remove-search-123-com-hijacker-virus-get-rid-of-search-123-com-manually/
http://blog.teesupport.com/remove-search-123-com-browser-hijacker-manual-removal-for-search-123-virus/
http://www.exterminate-it.com/malpedia/remove-search123
http://www.pcfixessupport.com/how-to-fix-search-123-com-redirection-problem-search-123-com-hijacker-virus-removal-instructions/