deleting virus has wiped my mail programme

Question

Level 1

8 points

deleting virus has wiped my mail programme

Hi there,

I need some help please.

I had some infections found on my Mac, and yesterday when I was deleting them, I didn't realize at the time, that it was also wiping out my 6000 odd emails. ( still have them on the web, but still a pain).

then a few hours later, about 1000 emails came in. (randomly chosen, it seems), but now I can't get my mail to download, or send, or basically do anything.

I had googled the names of the infections, 3 of them were in email, and it said to only delete them in mail, so as not to disrupt the mail settings. Thought I had done that, but maybe I wasn't as good as I thought I was..

Can anyone help me get my email up and running again?

MacBook Pro, OS Yosemite 10.10

Posted on May 8, 2015 10:36 PM

Reply

Answer 1

SeaPapp

Level 7

26,492 points

May 9, 2015 4:12 AM in response to kiwi57ienz

First your Mac didn't have a virus. You may have received emails with attached windows viruses which couldn't run on a Mac but simply deleting those specific emails would have removed them. What told you that your computer was infected? How did you remove the so called infected files?

Do you have a Time Machine backup?

Reply

Answer 2

thomas_r.

Level 7

32,031 points

May 9, 2015 5:02 AM in response to kiwi57ienz

NEVER allow anti-virus software to remove what it thinks are "infected" e-mail messages. This corrupts your Mail mailboxes, and doesn't properly remove the messages from the mail server anyway. You will need to rebuild your mailboxes in Mail (select them one at a time, and choose Rebuild from the Mailbox menu).

As for how to properly remove such things in the future, see:

How to remove infected files

(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)

Reply

Answer 3

kiwi57ienz Author

Level 1

8 points

May 10, 2015 1:04 AM in response to thomas_r.

I was advised to run a "clamXav" scan.

These were the results:

102792.emlx Heuristics.phishing.email.spoofeddomain

150247.mlx Heuristics.phishing.email.spoofeddomain

39667.mlx Email.trojan-256

page.webarchive HTML.exploit.cve_2014_0528-3

Page.webarchive HTML.exploit.CVE_2014_6327

page.webarchive Html.EXPLOIT.CVE_2014_6327

SO, when I googled the first 3, it was suggested that the viruses could be dealt with in the email programme, and should be deleted.

This was what I found:

When possibly infected e-mail files are found:

- Highlight the entry in the ClamXav window's top pane that needs to be dealt with.

- Right-click/Control-click on the entry.

- Select "Reveal In Finder" from the pop-up menu.

- When the window opens, double-click on the file to open the message in your Apple Mail app.

- Read the message and if you agree that it is junk/spam/phishing then use the e-mail client's delete button to delete it (this is especially important when the word "Heuristics" appears in the infection name).

- If you disagree and choose to retain the message, return to ClamXav and choose "Exclude From Future Scans" from the pop-up menu.

Reply

Answer 4

thomas_r.

Level 7

32,031 points

May 10, 2015 3:55 AM in response to kiwi57ienz

kiwi57ienz wrote:

I was advised to run a "clamXav" scan.

These were the results:

102792.emlx Heuristics.phishing.email.spoofeddomain

150247.mlx Heuristics.phishing.email.spoofeddomain

39667.mlx Email.trojan-256

page.webarchive HTML.exploit.cve_2014_0528-3

Page.webarchive HTML.exploit.CVE_2014_6327

page.webarchive Html.EXPLOIT.CVE_2014_6327

The information you found on how to deal with the first three was exactly right. They may or may not need to be deleted, but should only be deleted from within Mail, so follow those directions to find them and evaluate whether to delete them or not. You don't need to fear opening these messages in Mail... there is no malware capable of infecting a Mac just by opening an e-mail message. (Just don't open any attachments!)

As for the last three, these are all web-based exploits found on pages you have visited. The first is an exploit for older versions of Adobe Acrobat Reader. Most Mac users don't have that in the first place, since the system has support for PDF files at a very low level, and can open them just fine in built-in apps like Preview. The second two are vulnerabilities in Internet Explorer, which only affects Windows users.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0528

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6327

Reply