Second Life Forums Archive

Jesseaitui Petion

king of polynesia :P

Join date: 2 Jan 2006

Posts: 2,175

03-03-2009 19:15

Hey all, quick resident question here as you guys seem to know more than LL does ...

Today I received a txt message from an SL friend asking "Did you just send me something to download?" I thought it weird and logged online, when I got on, I had a few email inquiries asking the same question... All from SL friends.

When I checked my "sent mail" folder, there was a sent mail from my email account that I didnt send. The recipients were all yahoo email addresses, all of them members of SL. It also was sent to xstreet and about 15 other temporary email addresses @im.agni.lindenlab.com (Which is the email address you send things to when you reply to an IM offline from your email account)

I changed my password but I am wondering if anyone else had this happen to them?

Was I hacked? I certaintly did not send out the email yet the email was sent from my account to SL residents.

Oh, the title of the email was ">>>>>>>> A SURPRISE FOR YOU <<<<<<<<<" and inside the email said "Download it! " followed by a URL i`m assuming was some sort of virus.

Any ideas how I was exposed to it this? Could I have been exposed while inside of SL? The email address it was sent from was the same one I have hooked up to SL for receiving offline IMs; and again everyone who received it is an SL resident or associated with sl (xstreet). Anything I should watch out for? Never had this happen before and not sure exactly what happened...

Thanks

_____________________

a i t u i // Tattoo & Fashion House

http://slurl.com/secondlife/Aitui/127/128/41

Marin Mielziner

Registered User

Join date: 19 Mar 2007

Posts: 293

03-03-2009 19:22

It sounds to me as if your email address book was mined, maybe by a virus you downloaded, or a worm like the one that's hit facebook. It sounds like they email your SL friends because you had stored IMs? I know that in gmail, if I get an offline IM, gmail "remembers" the address.

You should make sure your anti virus program is update and then scan your computer. Change all your passwords as well.

Jesse Barnett

500,000 scoville units

Join date: 21 May 2006

Posts: 4,160

03-03-2009 21:01

Yep you have a virus and it not related to SL.

A couple of decent free antivirus programs are AVG or Avira. Once you have it clean with one then uninstall it and install a different antivirus to be sure. If you have an antivirus currently installed, uninstall if first, it has already been corrupted. You can reinstall it after your computer is clean. Hopefully all it wants is to replicate without damaging your system too much but it will download more. You should keep your system off until you have the time to run the antivirus programs and clean it up. If you don't then you could face the possibility of having to completely reinstall your operating system. Another program I use is Spybot SD, it will clean a lot of the trash off the computer and you can immunize it, which will create a hosts files to keep your computer from connecting to most of the bad sites.

Good Luck

PS A great place for info and help is Major Geeks.

http://forums.majorgeeks.com/forumdisplay.php?f=35

Read the "READ & RUN ME FIRST. Malware Removal Guide" stickie up top and follow those directions first.

_____________________

I (who is a she not a he) reserve the right to exercise selective comprehension of the OP's question at anytime.

From: someone

I am still around, just no longer here. See you across the aisle. Hope LL burns in hell for archiving this forum

SuezanneC Baskerville

Forums Rock!

Join date: 22 Dec 2003

Posts: 14,229

03-03-2009 21:06

This thread sounds like other Yahoo email users are having this problem: http://answers.yahoo.com/question/index?qid=20090220174549AAJHEM7 .

I suppose I will have to check my yahoo email accounts.

_____________________

-

So long to these forums, the vBulletin forums that used to be at forums.secondlife.com. I will miss them.

I can be found on the web by searching for "SuezanneC Baskerville", or go to

http://www.google.com/profiles/suezanne

-

http://lindenlab.tribe.net/ created on 11/19/03.

Members: Ben, Catherine, Colin, Cory, Dan, Doug, Jim, Philip, Phoenix, Richard,
Robin, and Ryan

-

Void Singer

Int vSelf = Sing(void);

Join date: 24 Sep 2005

Posts: 6,973

03-03-2009 23:12

I believe that yahoo messenger is probably the vector of that attack, since I've seen a huge upswing of random crap there, including at least one related crash of the app. do not enable automatic logins or automatic web sign in from there... just don't.

_____________________

|
| . "Cat-Like Typing Detected"
| . This post may contain errors in logic, spelling, and
| . grammar known to the SL populace to cause confusion
|
| - Please Use PHP tags when posting scripts/code, Thanks.
| - Can't See PHP or URL Tags Correctly? Check Out This Link...
| -

Jesseaitui Petion

king of polynesia :P

Join date: 2 Jan 2006

Posts: 2,175

03-04-2009 00:26

Oh I made a mistake, I guess I was rushing earlier to change passwords, etc. The email is actually *not* in my "Sent mail" folder, BUT i had a bunch of "failed delivery" (From the email to IM SL send attempts) and one sent to my own yahoo account in the *spam* folder, and it said it was sent from my yahoo account. Very strange. I guess the SL thing was a coincidence as I`ve sent so many messages to SLers offline and then the few SL residents the spam got sent to... They must be in my "address book" or something. I`ll have to find it and delete it.

Im not so sure my system is infected, ran some scans and its coming up blank.

Thanks for the link Suzanne. Someone there actually states they think it is Yahoo itself..

Ah sorry for bothering this forum with this, I just thought it had been SL-related.

Yes, I am on the automatic feature, I`ll disable it.

Thanks for the help!

_____________________

a i t u i // Tattoo & Fashion House

http://slurl.com/secondlife/Aitui/127/128/41

Rhaorth Antonelli

Registered User

Join date: 15 Apr 2006

Posts: 7,425

03-04-2009 01:36

ouch!

hope you get it all cleared up.
I do not use yahoo, so can't help you there

sounds scary though, to see that.

(I never click links in emails, not even from people I know) heh yeah I am paranoid, have had to deal with too many viruses *is viruses right? if not what is the plural for virus?*

_____________________

From: someone

Morpheus Linden: But then I change avs pretty often too, so often, I look nothing like my avatar.

They are taking away the forums... it could be worse, they could be taking away the forums AND Second Life...

Amalia Broome

Registered User

Join date: 2 Mar 2007

Posts: 108

03-04-2009 02:55

Had a similar problem but found out someone hacked my yahoo account and attached an 'on vacation' announcement to every email I received. It was directing them to a website that sold computer equipement. I even got an IM from someone in SL saying I'd spammed her - she was NOT on my friends list but in a group I belonged to! Incidentally, the site orginated in China. When I realized it, I changed my password and deleted the message..now I change passwords on everything every couple of weeks...(changed my SL password too)....

Raudf Fox

(ra-ow-th)

Join date: 25 Feb 2005

Posts: 5,119

03-04-2009 04:25

*blinks* Haven't had the email sent thing with my yahoo account, but then I only have three contacts and two of them are in my household. The third... I think it's a friend's defunct.

_____________________

DiamonX Studios, the place of the Victorian Times series of gowns and dresses - Located at http://slurl.com/secondlife/Fushida/224/176

Want more attachment points for your avatar's wearing pleasure? Then please vote for

https://jira.secondlife.com/browse/VWR-1065?

Ralektra Breda

Template Painter

Join date: 7 Apr 2008

Posts: 1,875

03-04-2009 04:36

I've seen a lot of this before on WoW, it happens constantly. Farming is too time consuming I guess.

It might be a virus, as suggested previously. It might also be that someone has guessed/forced/known your email password and nicely mailed off a keylogger to all your friends hoping to get into their accounts. Bad. They may also have keylogged you. More bad (because if that is so, changing your password won't help).

I'm not saying this is what happened but it is a possibility. Especially since people on SL were targeted.

_____________________

Mainstore: http://slurl.com/secondlife/Phantasm/51/164/501
http://rbzdesign.blogspot.com/
I'm not a designer IRL, but I RP one on SL!

Ainee Kohime

Registered User

Join date: 29 Jun 2007

Posts: 101

03-04-2009 04:52

This happened recently to someone I know on Sl, she said that she had her Linden acount hacked, but who is who on SL? I recommended that she contacted SL support at once. I have not heard back from her, but I shall alert her to the Yahoo Virus problem.

Best wishes from Ainee Kohime

Welcome to the Second Life Forums Archive

I was "hacked"

I was "hacked"
Jesseaitui Petion king of polynesia :P Join date: 2 Jan 2006 Posts: 2,175	03-03-2009 19:15 Hey all, quick resident question here as you guys seem to know more than LL does ... Today I received a txt message from an SL friend asking "Did you just send me something to download?" I thought it weird and logged online, when I got on, I had a few email inquiries asking the same question... All from SL friends. When I checked my "sent mail" folder, there was a sent mail from my email account that I didnt send. The recipients were all yahoo email addresses, all of them members of SL. It also was sent to xstreet and about 15 other temporary email addresses @im.agni.lindenlab.com (Which is the email address you send things to when you reply to an IM offline from your email account) I changed my password but I am wondering if anyone else had this happen to them? Was I hacked? I certaintly did not send out the email yet the email was sent from my account to SL residents. Oh, the title of the email was ">>>>>>>> A SURPRISE FOR YOU <<<<<<<<<" and inside the email said "Download it! " followed by a URL i`m assuming was some sort of virus. Any ideas how I was exposed to it this? Could I have been exposed while inside of SL? The email address it was sent from was the same one I have hooked up to SL for receiving offline IMs; and again everyone who received it is an SL resident or associated with sl (xstreet). Anything I should watch out for? Never had this happen before and not sure exactly what happened... Thanks _____________________ a i t u i // Tattoo & Fashion House http://slurl.com/secondlife/Aitui/127/128/41
Marin Mielziner Registered User Join date: 19 Mar 2007 Posts: 293	03-03-2009 19:22 It sounds to me as if your email address book was mined, maybe by a virus you downloaded, or a worm like the one that's hit facebook. It sounds like they email your SL friends because you had stored IMs? I know that in gmail, if I get an offline IM, gmail "remembers" the address. You should make sure your anti virus program is update and then scan your computer. Change all your passwords as well.
Jesse Barnett 500,000 scoville units Join date: 21 May 2006 Posts: 4,160	03-03-2009 21:01 Yep you have a virus and it not related to SL. A couple of decent free antivirus programs are AVG or Avira. Once you have it clean with one then uninstall it and install a different antivirus to be sure. If you have an antivirus currently installed, uninstall if first, it has already been corrupted. You can reinstall it after your computer is clean. Hopefully all it wants is to replicate without damaging your system too much but it will download more. You should keep your system off until you have the time to run the antivirus programs and clean it up. If you don't then you could face the possibility of having to completely reinstall your operating system. Another program I use is Spybot SD, it will clean a lot of the trash off the computer and you can immunize it, which will create a hosts files to keep your computer from connecting to most of the bad sites. Good Luck PS A great place for info and help is Major Geeks. http://forums.majorgeeks.com/forumdisplay.php?f=35 Read the "READ & RUN ME FIRST. Malware Removal Guide" stickie up top and follow those directions first. _____________________ I (who is a she not a he) reserve the right to exercise selective comprehension of the OP's question at anytime. From: someone I am still around, just no longer here. See you across the aisle. Hope LL burns in hell for archiving this forum
SuezanneC Baskerville Forums Rock! Join date: 22 Dec 2003 Posts: 14,229	03-03-2009 21:06 This thread sounds like other Yahoo email users are having this problem: http://answers.yahoo.com/question/index?qid=20090220174549AAJHEM7 . I suppose I will have to check my yahoo email accounts. _____________________ - So long to these forums, the vBulletin forums that used to be at forums.secondlife.com. I will miss them. I can be found on the web by searching for "SuezanneC Baskerville", or go to http://www.google.com/profiles/suezanne - http://lindenlab.tribe.net/ created on 11/19/03. Members: Ben, Catherine, Colin, Cory, Dan, Doug, Jim, Philip, Phoenix, Richard, Robin, and Ryan -
Void Singer Int vSelf = Sing(void); Join date: 24 Sep 2005 Posts: 6,973	03-03-2009 23:12 I believe that yahoo messenger is probably the vector of that attack, since I've seen a huge upswing of random crap there, including at least one related crash of the app. do not enable automatic logins or automatic web sign in from there... just don't. _____________________ \| \| . "Cat-Like Typing Detected" \| . This post may contain errors in logic, spelling, and \| . grammar known to the SL populace to cause confusion \| \| - Please Use PHP tags when posting scripts/code, Thanks. \| - Can't See PHP or URL Tags Correctly? Check Out This Link... \| -
Jesseaitui Petion king of polynesia :P Join date: 2 Jan 2006 Posts: 2,175	03-04-2009 00:26 Oh I made a mistake, I guess I was rushing earlier to change passwords, etc. The email is actually not in my "Sent mail" folder, BUT i had a bunch of "failed delivery" (From the email to IM SL send attempts) and one sent to my own yahoo account in the spam folder, and it said it was sent from my yahoo account. Very strange. I guess the SL thing was a coincidence as I`ve sent so many messages to SLers offline and then the few SL residents the spam got sent to... They must be in my "address book" or something. I`ll have to find it and delete it. Im not so sure my system is infected, ran some scans and its coming up blank. Thanks for the link Suzanne. Someone there actually states they think it is Yahoo itself.. Ah sorry for bothering this forum with this, I just thought it had been SL-related. Yes, I am on the automatic feature, I`ll disable it. Thanks for the help! _____________________ a i t u i // Tattoo & Fashion House http://slurl.com/secondlife/Aitui/127/128/41
Rhaorth Antonelli Registered User Join date: 15 Apr 2006 Posts: 7,425	03-04-2009 01:36 ouch! hope you get it all cleared up. I do not use yahoo, so can't help you there sounds scary though, to see that. (I never click links in emails, not even from people I know) heh yeah I am paranoid, have had to deal with too many viruses is viruses right? if not what is the plural for virus? _____________________ From: someone Morpheus Linden: But then I change avs pretty often too, so often, I look nothing like my avatar. They are taking away the forums... it could be worse, they could be taking away the forums AND Second Life...
Amalia Broome Registered User Join date: 2 Mar 2007 Posts: 108	03-04-2009 02:55 Had a similar problem but found out someone hacked my yahoo account and attached an 'on vacation' announcement to every email I received. It was directing them to a website that sold computer equipement. I even got an IM from someone in SL saying I'd spammed her - she was NOT on my friends list but in a group I belonged to! Incidentally, the site orginated in China. When I realized it, I changed my password and deleted the message..now I change passwords on everything every couple of weeks...(changed my SL password too)....
Raudf Fox (ra-ow-th) Join date: 25 Feb 2005 Posts: 5,119	03-04-2009 04:25 blinks Haven't had the email sent thing with my yahoo account, but then I only have three contacts and two of them are in my household. The third... I think it's a friend's defunct. _____________________ DiamonX Studios, the place of the Victorian Times series of gowns and dresses - Located at http://slurl.com/secondlife/Fushida/224/176 Want more attachment points for your avatar's wearing pleasure? Then please vote for https://jira.secondlife.com/browse/VWR-1065?
Ralektra Breda Template Painter Join date: 7 Apr 2008 Posts: 1,875	03-04-2009 04:36 I've seen a lot of this before on WoW, it happens constantly. Farming is too time consuming I guess. It might be a virus, as suggested previously. It might also be that someone has guessed/forced/known your email password and nicely mailed off a keylogger to all your friends hoping to get into their accounts. Bad. They may also have keylogged you. More bad (because if that is so, changing your password won't help). I'm not saying this is what happened but it is a possibility. Especially since people on SL were targeted. _____________________ Mainstore: http://slurl.com/secondlife/Phantasm/51/164/501 http://rbzdesign.blogspot.com/ I'm not a designer IRL, but I RP one on SL!
Ainee Kohime Registered User Join date: 29 Jun 2007 Posts: 101	03-04-2009 04:52 This happened recently to someone I know on Sl, she said that she had her Linden acount hacked, but who is who on SL? I recommended that she contacted SL support at once. I have not heard back from her, but I shall alert her to the Yahoo Virus problem. Best wishes from Ainee Kohime