I have a virus that continues to appear but gets detected by ClamXav. The identified virus is 8399.emlx and it is found in my
/Users/(Mydirectory)/Library/Mail/IMAP-(My email)@imap.gmail.com/[Gmail]/All Mail.imapmbox/Messages/8399.emlx:
After it is found it reappears and the only function I am performing is Web browsng with no downloads. Anyone have any experience or knowledge of the virus?
MacBook Pro, Mac OS X (10.6.8)
macfrombrampton wrote:
I have a virus that continues to appear but gets detected by ClamXav. The identified virus is 8399.emlx and it is found in my
/Users/(Mydirectory)/Library/Mail/IMAP-(My email)@imap.gmail.com/[Gmail]/All Mail.imapmbox/Messages/8399.emlx:
Actually, that's the name of the e-mail message file that may be infected. It's not a virus nor is it the infection name.
After it is found it reappears and the only function I am performing is Web browsng with no downloads. Anyone have any experience or knowledge of the virus?
You don't say how you are trying to get rid of it, but there is only one way to safely process an infected e-mail and that is from within the e-mail client (Apple Mail in your case). Otherwise you will most certainly corrupt the mailbox index (which can usually be fixed by rebuilding the mailbox), could cause you to lose additional e-mails and as you found, sometimes does not delete the file from the server, so it comes to your computer again the next time you check for new mail.
You can either navigate to the location shown above or the next time ClamXav finds it, Right-click / Control-click on the file or infection name and select "Reveal In Finder" from the contextual pop-up menu. Once the file appears in the "Messages" window, double-click on 8399.emlx and read the message. If you agree that it is an infected message that you don't need, make note of the date and subject of the e-mail (you will need this in the step below) then use the Mail delete button to trash it, then if you have elected to move deleted message to the trash, be sure to empty the trash mailbox. If it appears to be a false alarm and is an e-mail you want to retain, write down the number so that you can ignore it during future scans.
With gmail accounts, there is sometimes an additional step to permanently delete the message. Log into your gmail account in webmail using your favorite browser. Go to the "All Mail" mailbox, search for that message using the subject and date copied above. Use the webmail delete button and again make sure to empty the trash if there's anything there.
And in the future I would encourage you to visit the ClamXav Forum where you will find the answer to most situations and usually a faster response if you don't find it.
macfrombrampton wrote:
MadMacs0 you are correct. I placed the filename the name of the Virus that Clamxav found is "Heuristic.Phishing.email.SpoofedDomain"
Heuristic means there is a chance that it guessed incorrectly and there is nothing wrong with the message. Phishing and SpoofedDomain means that as long as you don't click on the link and enter privacy information on the web site it takes you to, the message is harmless.
the file 8399.emlx was removed several times but it keeps coming back. Any ideas?
Huh? I spent about half an hour outlining detailed instructions on how to take care of it. Have you tried all of it?
macfrombrampton wrote:
I belive this is a valid virus.
There are no known viruses that effect Macs unless they are running Windows. "Heuristic.Phishing.email.SpoofedDomain" e-mails do not affect e-mail in any way. If valid the only way it can hurt you is if you click on the spoofed domain link which will open in your browser. There they will ask you for privacy information in an attempt to steal it (e.g. login and password, credit card number).
I noticed that when I sent an Email in some cases the Email was not sent. Once it was removed the Email message when through.
Coincidence.
How far did you get in the process I outlined above for permanently deleting this? WHat is the subject of the email? Who is it supposedly coming from? How long has it been in your email? If you don't do what I suggested it will be there forever.
I think I know what this malware does. ""Heuristic.Phishing.email.SpoofedDomain"" appears to allow a attacker to place mail directly into "Apple's Mail" even though it is not on your actual mail server. For example if you open Apples Mail you might see a mail, but you go to your mail server say Gmail, you will not find the mail read in by "Apple's mail"
This is a virus for 2 reasons
1) Clamxav finds this virus even though it has showed up with 3 different file names
2) I removed the file from mail and the Gmail server and it still shows up
Repeat: There are no known viruses for Mac OS X in the wild. If it were a virus your who HD would by now be erased or affected in some other way. ClamxXav and other AV software can raise false alarms. If it were a virus it would be so new that it would not even be in ClamX database.
Did I miss someone suggesting you plug the name of the virus into Google or another search engine and you will wind upwith several sources to find exactly what the virus is, it's orogination and if it's a problem or not. Over the years, starting with an amazing radio shack computer and original IBM pc, actually serial # 0004, I find simply deleting an email right within the e-mail system removes all traces and the only way to get the "virus" is to open the file or reply to an e-mail opening a link.
p.s. I am now all Apple so no confusion as to why I am on the forum - looking for my own answers!
This is a virus for 2 reasons
1) Clamxav finds this virus even though it has showed up with 3 different file names
2) I removed the file from mail and the Gmail server and it still shows up
MadMacs0 you are correct. I placed the filename the name of the Virus that Clamxav found is "Heuristic.Phishing.email.SpoofedDomain" the file 8399.emlx was removed several times but it keeps coming back. Any ideas?
Just to satisfy my curiosity, I scanned all my email last night and found three labeled as "Heuristic.Phishing.email.SpoofedDomain". All three were credit union newsletters with a real link to the IRS, which is one of the clamav protected sites.
This virus appears to be coming from false Google alerts emailed to me. I would like to know from any other Macbook OS snow leopard if they know the function of this virus. If Clamav is able to identify it as "Heuristic.Phishing.email.SpoofedDomain" then there must be a function for this virus.
Viruses: Are programs that earn their name by their ability to replicate themselves locally & often across a network. Many attach themselves to to other programs. When you launch one of these programs, the virus code launches as well & the virus goes about its nefarious business. Viruses are exceedingly rare on the Mac. There are no known viruses for OSX.
Trojans: Promises one thing but delivers another. You can download a program but when you run the program, the contents of your computer are instead beamed to an underground data center in Kamchatka. If you obtain software from reliable sites, you are unlikely to get a Trojan horse.
Adware: Has an embedded advertising component - one that displays or downloads ads when you run the software. Some adware is legitimate, part of the price of using a free program such as the Iconfactory's Twitterrific or Eudora for example.
Spyware: Grabs data from your computer & ofen uses it for the purposes of evil, sending personal info to a baddie or when you're using your web browser, redirecting you to site you don't want to visit.
Mac users have nothing to worry about regarding Spyware & Adware because in order for the worse forms to work, the OS must allow unrestricted access to its more sensitive parts. The Mac OS doesn't.
Macintosh Viruses
It doesn’t get PC viruses.
Just this morning, I clicked on a link in an email from JustHost saying it had been hacked and I needed to get passwords changed. I was stupid and clicked on one. Now my mail won't function corrently. I can receive, I can delete, but I can't open any of my emails, old or new. I have a 10.4.11 MAC and I've always believed there weren't any MAC viruses. I believe this is proof that now there is at least one. I haven't accessed a gmail account.
Now how do I clean this virus up? I don't have a virus program for MAC. This is serious everyone!!
suefrommountainview wrote:
I've always believed there weren't any MAC viruses. I believe this is proof that now there is at least one
Wow! You have proof of a live Mac virus! So why waste it in a humble user forum? Why aren't you contacting the news agencies? Maybe it's not exactly fodder for breaking news on CNN or Fox, but, still…
Btw, if you have a problem, unless it's identical to what's covered in this thread, it's a good idea to create your own thread. This way, you have a better chance of getting help.
If it is not malware why is ClamAV identifing the specific file on my Mac?
Why do you think this is not Malware?
I am to understand that you think that Clamxav which can be downloaded from Apple store searches your files and displays after the search Heuristic.Phishing.email.SpoofedDomain so that a user can just look up the name?
This is why I have opened htis post. To try and determine what function this malware performs. Does anyone have any experience or suspisions as to what it may be doing other than what is in the name of the malware?
THere must be someone who can give the definition of this malware. All Malware are identiifed and given a name which means someone knows the function of this "Heuristic.Phishing.email.SpoofedDomain"
I am also trying the Clamav site.
Virus 8399.emlx
