Warning: My Thunderbird just got "spowned"

[curveto]

Like that? I just made it up. SPAM. Owned. Spowned.

Anyhow, I've sent the better part of two days now watching my speedy laptop do essentially nothing as I scanned it with multiple "offline" virus detect / removal tools (from MS and Kaspersky to be exact).

Why? You ask?

Because some baddy targeted some SPAM (with a evil payload) at my yahoo mail account. Did I click on it? Why, no in fact I did not. Yahoo dropped it in my Bulk / Spam folder and the process of EMPTYING the folder (which requires selection) in the latest and greatest Thunderbird managed to let them run an exploit that a) took Thunderbird down and b) dropped a specially crafted "profile" in Thunderbird's AppData/ work space.

ALL of this activity made it past Security Essentials, btw.

When I subsequently launched Thunderbird, I noticed my UI was acting a bit odd (I now know that the special profile was actually CHECKING email and then pulling down attachments, etc. from as if it were me). I immediately started getting all manner of Spam messages targeted at my email account (guess why).

CLUE: If you (like me, now) suddenly start to get all manner of spam take that as a clue that mayhaps someone has phoned home (from your box!) to put out a call to "send in the re-enforcements!"

Thinking something was odd (like my box was rooted) I ran Security Essentials *Offline* version and low and behold, WAAAAAAAY at the end of the file system search what does she find? ...a gaggle of really horrendous tools offering up all manner of access to/from my box. They were harder than snot to get rid of too. But I appear to have gotten all of them.

I also removed Thunderbird from my system so the crap that continues to arrive in my email account has no means to re-establish a beach landing.

Just sharing with some of my kin folk,