Malware

[Robin131]

I've recently received a "too many bad emails" alert from Internet security team resulting in email sending temp. frozen and now a possible malware (nymaim) alert.

I'm using a Mac desktop. I have MacAfee and have also run Avast - nothing found. Password changed.

What to do next - possible computer linked to a botnet?

[Anankha]

Try running these programs:
MBAM free: https://www.malwarebytes.com/mwb-download/ ensure scan for rootkits is enabled.
Eset online scanner: http://www.eset.com/us/online-scanner/
Adwcleaner: https://www.malwarebytes.com/adwcleaner/
Also check the router to see if there are any unknown connections:
https://www.f-secure.com/gb-en/home/free-tools/router-checker

If these find one or more infections but do not fully remove them it will be wise to register with a malware removal site to receive dedicated malware removal instructions, an expert will remain with you throughout the process until confirmation that your PC is 100% clean.
Malwarebytes virus/malware removal forum:
https://forums.malwarebytes.com/forum/7-windows-malware-removal-help-support/
Bleeping computer malware/virus removal forum:
https://www.bleepingcomputer.com/forums/forum22.html

[Steven_L]

Hey Robin131,

Welcome to the community and thanks for taking the time to post here on the forums.
I’m sorry to hear of the issues that you’re having at the moment. Have you had chance to run any of the tests that Anankha has suggested?

Kind Regards,

Steven_L

[Robin131]

Hi Steve

I have downloaded and run Malwarebytes -  wasn't sure how to enable rootkits scan but enabled full disc access as instructed. Nothing reported.

Run F-Secure Router checker - nothing reported

Avast Network inspector warns Router Arris is accessible from internet - advised to close open port ??

Robin

[Robin131]

Hi Steven_L

Tried to check router Arris "open port" warning but password not working (incorrect password) for Hub 3 router.

I haven't changed it

Robin

[Graham_A]

---

@Robin131 wrote:

Hi Steven_L

Tried to check router Arris "open port" warning but password not working (incorrect password) for Hub 3 router.

I haven't changed it

Robin

---

If you haven't changed the default settings passcode for the Hub3 it will be the numeric code printed on the label on the base of the Hub.

[Robin131]

That is the passcode I am using

[jem101]

---

@Robin131 wrote:
That is the passcode I am using

---

In that case, it is highly likely that the hub was and is ‘second hand’, ie someone else’s return which VM, sort of, neglected to properly reset before passing it on to you! You could, if you want, do a full factory reset by using a paperclip to press in the reset button on the back, hold it in, you will feel a click as the button is depressed, for a good 60 seconds and allow the hub to reset itself. After that the password(s) on the sticker on the base of the hub should work OK.

[Travis_M]

Hi @Robin131

Thanks for posting on our community forum and sorry to hear about your issue

Have you had any further luck after trying the above tip from our very helpful Jem101?