Still wondering about possible virus (What's .HQX?)

[Ed_L]

I have not been able to find a virus on my computer or my wife's, even though I've done several scans, both online and local. But I recently received an e-mail that seemed to come from my wife, but it didn't. It had an attachment, which I didn't open.

During an online scan, using Panda ActiveScan, the scanning stopped while it was on a file named 9ancl6b\megansketch.exe[1].hqx. Through a Google search, it seems the .hqx extension has to do with a Mac. I'm using a Windows XP computer. I was unable to find anything relating to the specific file, but since it's an.exe file, I'm wondering if it could be a virus?? I hate to format the computers and start over if not necessary.

Ed

[Leah]

If I recall correctly, that megansketch file is from one of Shan's tutorials -- I doubt it's a virus. If you're uneasy, then delete the file and empty your recycle bin, then run your virus checker again.

It really doesn't sound to me like you have a virus -- what you did get was an email attempting to give you a virus that was spoofing your wife's email address, but since you did the right thing and deleted it it shouldn't have created a problem.

I assume you're keeping your Panda signature files up to date? [mental image of Ed approaching a giant panda at the zoo: "Excuse me, Ms. Cha Cha, but may I have your autograph for my files?"]

[Ed_L]

That's funny! I received an e-mail that had a subject line, something like "Protected Files" or something like that. The thing is that I'm not even in her address book! I only used the Panda software online. It's not my regular virus protection. Thanks for the reply.

Ed

[Leah]

Is she in your address book?

[painperdu]

Here's a reference to the file here at RP for what it's worth:
http://www.retouchpro.com/forums/image-help/7440-can-someone-help-newbie-please.html

[Ed_L]

Originally Posted by Leah

Is she in your address book?

Yes, she is. But what difference would that make?

Ed

[Ed_L]

Originally Posted by painperdu

Here's a reference to the file here at RP for what it's worth:
http://www.retouchpro.com/forums/showthread.php?t=7440

Aha! Thanks for the post.

Ed

[Leah]

Actually whether she's in your address book doesn't particularly matter, so long as she's in someone's address book -- many e-mail viruses now use random e-mail addresses from an infected computer's address book in the FROM and TO fields of messages the virus sends. Most likely the virus on someone else's computer has found your wife's e-mail address in an address book and used it in the FROM field as the virus replicates itself via e-mail. The messages look like they came from her, but they did not. This is called e-mail spoofing. So one very good possibility is that this virus actually came from someone who has both your email address and your wife's in his/her email address book. If you get another one it may be an idea to have a look at the full headers for the email which could give you a clue as to whose computer is really sending these messages out.

[Ed_L]

Yeah, I knew about spoofing.

Originally Posted by Leah

If you get another one it may be an idea to have a look at the full headers for the email which could give you a clue as to whose computer is really sending these messages out.

I'll keep that in mind, and I'll also have my kids check out their address books. It could possibly be coming from one of them. Thanks.

Ed

[JustChecking]

when it comes to viruses, i always recommend the Alwil-AVAST antivirus - it's a traditional Virus Bulletin's test winner w/ 100% of finds, and what's better, its home edition has been released few years ago for free for noncommercial use - you can get the home edition from here: http://www.avast.com/eng/down_home.html ...

and as for the spy-ware and similar, i have a good experience w/ the Lavasoft Ad-Aware - personal version is again available for free for noncommercial use - list of download sites is here: http://www.lavasoftusa.com/support/download/ (see the bottom of the page)

[Ed_L]

I've been running AVG, and I've been well satisfied with it so far. But this one looks very interesting, and it's now on my favorites list. The seperate virus remover program looks promising as well. Thanks for the link.

Ed