my yahoo was hacked

[LauraMc]

I apologize to anyone who got some e-mails from me with spam. Got hacked somehow this evening but McAfee didn't catch it. I changed my password so hopefully it stops.

[Shep]

While in yahoo, my computer has been getting attacked by a fake security program that tries to scan my computer. When it slips past norton, it becomes very hard to close and you have to shut down. Most of the times it is intercepted but not everytime, is anyone else getting this?

[Admin]

"Personal Security" is the latest version of several similar "scareware" malware programs designed to make you believe your computer has detected a virus and that a scan is underway by Windows Security Center. Infection may be caused by navigating to a malicious or hacked website, or unsuspectingly running an email attachment. The apparent intent is to get the affected PC owner to purchase a "full version" of a supposed anti-virus software to remove the bogus viral infection. Symptoms may include repeated "scan" pop-ups, search engine re-direction, crippling of legitimate installed anti-virus programs, disabling of the installation and running of anti-malware programs, and denial of access to legitimate websites.

The pop-ups typically include, as above, fake security scans and other messages designed to confuse the viewer. Closer inspection reveals that one is not actually looking at Windows Explorer or Security Center, but rather an animated web page. Clicking on any link or button, or in fact anywhere within the page or other message pop-up will cause installation of the malware. If one clicks only on the close window X at the upper right of such windows or pop-ups, infection may possibly be avoided.

If infected, removal is a fairly straightforward procedure. Access to another, uninfected PC, and a USB flash drive are helpful. Download MalwareBytes Anti-Malware, and copy the installation file to the flash drive. Also needed is a malware process killer called rkill. Copy it to the flash drive as well.

Boot the infected computer in Safe Mode by restarting it and repeatedly pressing the F8 key as the computer start up begins. At the start up screen, choose "Safe Mode with Networking". Once booted, open Windows Explorer and navigate to the flash drive. Double-click on rkill to run it. A command prompt window will briefly open as rkill does its job. Next, double-click on the MalwareBytes icon to install it. Choose the option to simultaneously update the program. Once installed, run a full scan on all drives. This part of the process may take 45 minutes to an hour or more, depending on how many drives you have, and how big they are. Attempting to see if you can uninstall Personal Security in your Control Panel during the scan will actually invoke the malware, and abort the scan. You will have to reboot and start the process over again.

[EatinAintCheatin]

Yet another reason to switch to Linux. I have been running the Ubuntu Remix distribution of Linux on my netbook and before that another version of Ubuntu on my laptop for over a year. I have no anti virus software and have not been infected yet.

There are very few viruses written for the Linux operating system and the ones that have been written are rarely able to infect due the the way Linux handles security.

It's free, it's stable and it's fast. If all you use is browser and office applications I highly recommend it.

[buzd]

Most of the infections of this sort I have seen have come from facebook.

[Admin]

I was doing some web searching yesterday, and encountered it twice, both times on western European domains. When you try to close the fake scan window, you get a confirmation pop-up asking if you want to navigate away from the page. This is the only thing you want to actually click 'Yes' on that will get you out of the loop.

[LauraMc]

I have been getting that fake security alert thing for a while now. It could be facebook. I have been scanning and McAfee did not catch it. Even after the hacking incident, it didn't catch it. I did figure out though that I had my Java security settings too low and that's how it was sneaking in.
Thanks Admin for the instructions. I'll have to do that this weekend. For now, just changing my password on yahoo stopped the e-mails. My sister thought I really sent her a Cialis ad.

[Isabella Maja]

Yeah, at first I thought you sent me a good deal on meds, since you were a nurse. How nice. But then saw it was for Viagra & knew you couldn't have possibly done it!

[Schuarta]

I was hit by this virus in January. It's a nasty piece of work.

I have both Webroot Internet Security Essentials (always running), and Super Anti-Spyware 4.33.1000 (quiescent on board). The Webroot did not stop it, nor did it defeat it when the "full scan" was run. However, Super Anti-Spyware, when ran for a "full scan" nailed it, and I have not had a reoccurrance since.