Possible Malware Infection

[BlueMacawBird]

Recently my ISP began blocking my outgoing emails, the ones containing links I was sending. The message from the ISP was that the mail item had been blocked due to "spam content". At first I suspected that my ISP had an overly aggressive spam filter, but I find that one of my three primary machines can actually send an email with a link, and not get the message about spam content. The messages looked OK to me but at this point I have to conclude that I have two machines that are infected with some kind of malware. The two infected machines are running Mojave, and the third machine that is OK had been running Mojave but was recently updated to Big Sur. I get the same results with both Safari and Firefox when sending links.

I have no problem sending emails that do not contain links.

So, the first question is do you all think that I in fact have malware?

And second, what anti-virus / anti-malware software have you had good results with? I would be interested in such software that can be found on the Mac App Store.

Thanks,

John

 

[Apple_Robert]

MacOS does has built in Malware prevention. If you want to put your mind at ease, download Malwarebytes.

 

[BlueMacawBird]

I knew that MacOS had built in malware protection, but I had no idea as to how effective it is. The fact that I'm having some kind of issue suggests that something is getting by it. Assuming that my problem really is some kind of malware.

Can you think of anything other than malware that could be causing the problem?

 

[Fishrrman]

Download MalwareBytes and run it:

Official Site | Malwarebytes: Antivirus, Anti-Malware & Privacy

Malwarebytes offers advanced antivirus, anti-malware, privacy and scam protection for all your devices. Protect your digital life today.

www.malwarebytes.com

IMPORTANT:
Select the "home" option.
It's a FREE download

IMPORTANT:
You DO NOT NEED TO BUY A SUBSCRIPTION to run MalwareBytes.
It will run FOREVER IN FREE MODE.
When you open it, IGNORE the button to "Upgrade Now" or "Activate License".
Just click "Scan".
Again, you DO NOT have to buy the pay-for version!

You CAN pay to register it if you wish. The cost is very reasonable.
Do this, and it will offer malware scanning/protection "in real time", continuously.

The free version only runs when you launch it manually.

 

[BlueMacawBird]

I downloaded the Malwarebytes for home and ran the scan. It found nothing, but it seemed to finish in very little time (I'm assuming it would search the entire system and with the attached drives that's about 3TB of files).

This is what the report looks like:

 

[Fishrrman]

Looks good to me.

 

[BlueMacawBird]

So it's that fast? Good. Now all I have to do is figure out why my ISP still insists my outgoing links have spam. Bummer.

 

[madrich]

Download MalwareBytes and run it:

Official Site | Malwarebytes: Antivirus, Anti-Malware & Privacy

Malwarebytes offers advanced antivirus, anti-malware, privacy and scam protection for all your devices. Protect your digital life today.

www.malwarebytes.com

IMPORTANT:
Select the "home" option.
It's a FREE download

IMPORTANT:
You DO NOT NEED TO BUY A SUBSCRIPTION to run MalwareBytes.
It will run FOREVER IN FREE MODE.
When you open it, IGNORE the button to "Upgrade Now" or "Activate License".
Just click "Scan".
Again, you DO NOT have to buy the pay-for version!

You CAN pay to register it if you wish. The cost is very reasonable.
Do this, and it will offer malware scanning/protection "in real time", continuously.

The free version only runs when you launch it manually.

Thank you, Fishrrman!

 

[DeltaMac]

Maybe those links that you use simply are caught by the email provider's spam filter.
Might not be actual malware, but trigger the ISP's spam filter, which sometimes is very sensitive to certain words in an email title, for example.
Review this article - https://www.campaignmonitor.com/blog/email-marketing/whats-considered-email-spam-avoid/

 

[BlueMacawBird]

At first I was sure it was an overly aggressive spam filter at my ISP, but then I noticed that my MacBook Air could send email without any problem. It was also running Mojave at that time, and had been cloned from one of the other machines that are now having problems, abut a year ago. Which is puzzling. I was going to nuke the two offending machines, but not yet. I'll call my ISP this coming week (not on the weekend, they'll be too busy) and ask them about it. I have little hope for them but it is worth a try. I know from past experience that they do not support email clients, but want subscribers to use their web based email. Which I hate. Although maybe it is worth a try to see if the same "spam content" message is generated when using the web mail.

 

[madrich]

At first I was sure it was an overly aggressive spam filter at my ISP, but then I noticed that my MacBook Air could send email without any problem. It was also running Mojave at that time, and had been cloned from one of the other machines that are now having problems, abut a year ago. Which is puzzling. I was going to nuke the two offending machines, but not yet. I'll call my ISP this coming week (not on the weekend, they'll be too busy) and ask them about it. I have little hope for them but it is worth a try. I know from past experience that they do not support email clients, but want subscribers to use their web based email. Which I hate. Although maybe it is worth a try to see if the same "spam content" message is generated when using the web mail.

Do you have a backup of your computer before this problem developed? If so, restore your computer to that backup, and see if the problem has gone away.

 

[BlueMacawBird]

I have TM and Super Duper backups for both machines. I booted the iMac off the SD backup and the same "spam content" error was found. I have not tried to restore a TM backup, that might need to happen but will take a lot more effort.

There is some improvement, I now find that some links can be sent. Amazon and some YouTube links got through. Other links still cause problems, including the ISP's own website. Today I called their tech support and got them involved. There is no resolution yet but the issue has been moved to the support staff who hopefully can deal with it. I hope to hear from them in a couple of days.

 

[madrich]

Looks good to me.

I am not saying it makes a difference, the graphic display of the Malwarebytes looks like the prior software version.

 

[Gregg2]

I know that several people here continue to recommend Malwarebytes. However, over on Mac Forums, it has fallen out of favor. DetectX Swift is now the "go to" app for malware over there. I've never seen it recommended by anyone else on this forum. I guess no one here has tried it. I've had both, and don't remember needing to run either one more than once, a "just curious" trial run after downloading. Several users of Malwarebytes on the other forum have reported problems with it in the last year. It just seems weird that no one here has the same complaints.

 

[BlueMacawBird]

My ISP never called me back (surprise). But I think they did something, as I can now send emails with links, and not have them blocked for having spam. I've been afraid to announce that, figuring that as soon as I claimed victory the circus will start over again. Anyway, I'll keep a sharp eye on things and hope they stay working.

Thanks for all the help and suggestions,

John