Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Virus on Gmail

G

gadgetfreaky

macrumors 65816
Original poster
Oct 28, 2007
1,406
533
So I am not sure how I got this virus or what happened...but somehow --a virus logged into my gmail account and sent out 500 random messages.

The messages themselves are odd...they have no subject.
then it has a random link to a website with a domain ending co.cc.

Anyone know what this virus is? Importantly, how do I get rid of it?
 
There are no known viruses on Mac OS X, so its likely not your Mac.

Do you also use Windows? If so, check that system and make sure it's virus free.

There's also the chance that someone hacked your gmail remotely and sent
the emails from their system. I'd change my password immediately.

So when you look in your gmail sent folder, there are 500 messages sent? Or did you get 500 bounced replies in your inbox?
 
It could also be that they're just spoofing your address, which is very easy to do and is a common practice among spammers as one method of bypassing spam filters. A few years ago, a spammer latched onto one of my personal addresses (@ my own domain) and started sending out thousands of emails, which I only discovered because I received hundreds of "this message could not be delivered" autoreplies.
 
Gmail shows the IP address.....it's all me.

The link is to some foreign drug pharmacy.

I run windows but was on mac at the time it sent out all the emails.
It's really disturbing.

aristobrat said:
There are no known viruses on Mac OS X, so its likely not your Mac.

Do you also use Windows? If so, check that system and make sure it's virus free.

There's also the chance that someone hacked your gmail remotely and sent
the emails from their system. I'd change my password immediately.

So when you look in your gmail sent folder, there are 500 messages sent? Or did you get 500 bounced replies in your inbox?
Click to expand...

it's 500 SENT!!!
i.e.
UUGGGGGHHHH

I think it takes the fact that you are logged into gmail and just sends the emails that way. yet somehow it is able to go thru my entire contact list??
and while I do have windows 7 on this mac, I was running mac os. How do I find this damn thing and get rid of it?
 
gadgetfreaky said:
Gmail shows the IP address.....it's all me.
Click to expand...
Are you using a router, or is your Mac directly connected to the Internet? If you're using a router, is your Mac the only computer on your local network?

Do you have Mail.app on your Mac configured to use gmail, or do you only access gmail thru a web browser from your Mac?
 
aristobrat said:
Are you using a router, or is your Mac directly connected to the Internet? If you're using a router, is your Mac the only computer on your local network?

Do you have Mail.app on your Mac configured to use gmail, or do you only access gmail thru a web browser from your Mac?
Click to expand...

yes. yes.

and only use browser to use gmail.

It's really clever what it did. It's not gussing my password (altho I changed it).
It's simply acivating when I am logged in to Gmail. Then sends the emails with the pharmacy link. the link changes almost every email so it's not detecte but goes to the same pharmacy.

it has a super weird way of grouping contacts too.

The troubling thing is it appears to be doing it while in mac OS and there are few virus programs for mac. they assume it has no viruses. The only other explanation is that it works on a long delay --i havn't been on windows for a long time and they were all sent --all 500 of em around 230 PM PST
 
gadgetfreaky said:
So I am not sure how I got this virus or what happened...but somehow --a virus logged into my gmail account and sent out 500 random messages.

The messages themselves are odd...they have no subject.
then it has a random link to a website with a domain ending co.cc.

Anyone know what this virus is? Importantly, how do I get rid of it?
Click to expand...

From what you have reported, this is a one-time incident, despite the way you describe it which makes it sound like its going on continuously.

What apparently happened is that 500 messages were sent, at the same time that you were logged onto gmail on your Mac.

From that you have made the huge leap of faith that it only happens when you are logged on , and that you have a virus on your Mac ! (congratulations, you'll be a celebrity, the only Mac with a virus (and its very rare as its only infected your Mac ! )

You use phrases like "its only doing it...,and its simply activating" which make it sound like its going on all the time, then you say it just sent one single batch of 500.

Remove all your assumptions and just state the facts, what actually happened.

Which as far as I can see from your piecemeal accounts is,
1. you found 500 sent messages in your gmail account (exactly 500? Or is that a guess?).
2. They were sent at the same time you were logged on to gmail.
Are those the only two facts?

If they are, the most likely explanation is that someone else connected to your gmail account at the same time period you were logged in, and used it to send spam. There are numerous ways this could have happened, many of them not going anywhere remotely near your computer. A virus is the least likely, by a long long long way, probably number 1,246 out of 1,247. (and number 1,247 is that Aliens did it )
 
Virus on Gmail

I had the exact same problem yesterday, using Gmail on a Mac with Firefox. Hundreds of emails (didn't count 'em) sent with the same kind of .cc link mentioned in the original posting. A hacked Gmail account makes sense to me, none of the virus checking software I've downloaded & run (including Norton, Kaspersky, iAntiVirus and MacScan) shows a problem. I've changed my password to something much stronger.
 
Interestingly for the last two days I've also gotten emails at a Hotmail account inviting me to change my Gmail account settings. These are clearly bogus so I've deleted w/o reply, but it shows someones out there targeting gmail accounts. See below (I've XXXX'd out my account name):


Google Password Assistance‏
From: account-recovery-noreply@google.com
Medium riskYou may not know this sender.Mark as safe|Mark as junk
Sent: Thu 4/15/10 3:21 AM
To: XXXXX@hotmail.com

To initiate the password reset process for your
XXXXX@gmail.com Google Account, click the link below:

https://www.google.com/accounts/RP?c=CO7z3-zFtMPXzwEQ4pmX2Oi1mZ2qAQ&hl=en

If clicking the link above doesn't work, please copy and paste the URL in a
new browser window instead.

If you've received this mail in error, it's likely that another user entered
your email address by mistake while trying to reset a password. If you
didn't
initiate the request, you don't need to take any further action and can
safely
disregard this email.

Thank you for using Google.

For questions or concerns about your account, please visit the Google
Accounts
Help Center at http://www.google.com/support/accounts/


This is a post-only mailing. Replies to this message are not monitored
or answered.
 
???

I have had two friends contract whatever this thing is and they use windows. So it is either a cross platform virus or more likely stolen accounts that are just running through your entire contact history in gmail.
 
Same issue

Here's the facts:
1 - Running Mac OS X (Leopard)
2 - The emails were sent while I was neither logged on nor using my computer (I was out of town all day)
3 - A few days prior, I received a similar email from a friend of mine who realized she had a problem.
4 - I am on a wireless network at home with 2 other pcs.

Thoughts?
 
2 times!

The same thing just happened to me for the second time; the first time was a few months ago while i was using my same Macbook. I didn't realize until I had replies from the Mail Delivery Subsystem as some of the addresses sent to were expired college addresses.
I changed my password on Gmail and everything was fine, but a few days ago I updated that new password on my Ipod to check my mail, and BAM, at 1:45 AM today, 3 separate emails were sent out to 5 people each. the links were different in each email:

baccollasta.com/12_index.html
fotomariomaggiordomo.it/12_index.html
atmospheregioielleria.it/12_index.html

I have a theory that it's because I was on my Ipod, an Ipod Touch. I was also on a wireless network with hundreds of users at school, although the first time it happened I didn't go to this same school and don't remember specifics.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back