email problem [RESOLVED]

Welcome Guest ( Log In | Register )

Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Spyware, virus, trojan, fake security or privacy alerts? Read the malware cleaning guide.

> Geeks to Go! » Security » Malware Removal - HijackThis™ Logs Go Here

email problem [RESOLVED], receiving & sending emails unsolicited/approved

Options

nondaj View Member Profile	May 17 2008, 12:38 PM Post #1
Member Posts: 394 OS: XP Pro SP2	PC stats: Computer Specs: Dell XPS400 Dimension XP-Pro Version 2002 SP2 Pentium ® D CPU 2.80 GHz 2.79 GHz, 2.00 GB of Ram E Drive – Sony CD-RW CRX217 E IDE\CD Rom Sony F Drive – HL-DT-ST DVD+-RW GWA4164B Video Card – Nvidia GeForce 6800 Sound Card – Sigma Tel High Defin. Audio CODEC Problem: 1 - receipt of emails from unknown correspondents asking who I am and why I am emailing them 2 - noted in some emails I supposedly sent to one unknown correspondent, that a list exists of unknown people who are receiving emails from me. 3 - have just received an email and noted that the sender is one person but inside the email itself, the sender is listed as an entirely different person whom I know and who also knows the sender listed in the email in my inbox. 4 - maintain rules of NEVER forwarding emails, use blind copies, use copy/paste of info when possible, use notepad rather than MSWord as notepad appears not to use forwarding lines that appear in emails; have MailWasher program to monitor emails before they reach my Outlook Express mailbox, and monitor my address book constantly to make sure no foreign names are listed therein. 5 - have notified correspondents involved in situation in attempt to glean any information from them about how they handle emails and address book. Though have requested no forwarding of emails to me nor any I send to them, I feel they are not adhering to my requests and so may be contributing to the problem. Submitting Hi-Jack log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:15:02 AM, on 5/17/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Windows Defender\MSASCui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft Office\Office\WINWORD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.ewido.net/redirect.cgi?buy R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file) O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Magic%20Farm/Images/stg_drm.ocx O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe O24 - Desktop Component 0: (no name) - https://www.verizon.net/central/resources/i...emailheader.jpg -- End of file - 5543 bytes

loophole View Member Profile	May 17 2008, 02:51 PM Post #2
Geek Mod Posts: 9,218 From: Indiana U.S. A. OS: 2000, xp, xp pro, Linux	Hello nondaj, Your Hijack log looks good. Just a couple questions and then we will have a look and see if we find anything out of the ordinary QUOTE receipt of emails from unknown correspondents asking who I am and why I am emailing them Does anything appear in your outbox to these people? QUOTE 3 - have just received an email and noted that the sender is one person but inside the email itself, the sender is listed as an entirely different person whom I know and who also knows the sender listed in the email in my inbox. This sounds like a forwarded e-mail You received? Please download Deckard's System Scanner (DSS) and save it to your Desktop. Close all other windows before proceeding. Double-click on dss.exe and follow the prompts. When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

nondaj View Member Profile	May 17 2008, 03:37 PM Post #3
Member Posts: 394 OS: XP Pro SP2	Have not noted anything in my outbox re this people but will keep a check from now on. Re forwarded email - did not note that this particular email was forwarded - the info within it was a link to the Greeting Card site to which I belong. HOWEVER, I think most people that send me emails do so re sending pics/data via forwarding. I am really puzzled when I tell each person about the hazards of forwarding emails, that it seem to roll off their 'email backs' like water and the duck. Either just do not believe it or are simply too lazy to go through any extra effort in sending data and pics other ways. When I see re: re: re: in subject line or numerous perpendicular lines along the left side of an email - FORWARDING going on. So how to avoid such a situation I have yet to figure out unless I start ceasing communication with such people. Which means most of my address book goes down the drain as well as the pleasure one gets from emailing:(

loophole View Member Profile	May 17 2008, 05:38 PM Post #4
Geek Mod Posts: 9,218 From: Indiana U.S. A. OS: 2000, xp, xp pro, Linux	I understand, I don't like it when people forward either. I keep one secure e-mail that I use for Banks , bills etc. and one I use for friends. People really need to take privacy and confidentiality on the internet more seriously as you do. I'm afraid theres just not much you can do. Did you by chance run the DSS scan?

nondaj View Member Profile	May 17 2008, 07:09 PM Post #5
Member Posts: 394 OS: XP Pro SP2	Gee what is the DSS scan? So of course did not run it Will do so and where did I miss it? If it was on the site where I posted my log - the tech I was talking with, Wannabe1, had told me to ONLY download the Hi-Jack files, install and then post the log - do nothing else. So willing to do the DSS if I can find same.

wannabe1 View Member Profile	May 17 2008, 07:53 PM Post #6
Tech Administrator Posts: 13,941 From: Bozeman, Montana, USA OS: Windows 95, 98, 98SE, ME, Windows XP, Vista Ultimate X64	Second Post, nondaj. http://www.geekstogo.com/forum/index.php?s...t&p=1240595

loophole View Member Profile	May 19 2008, 03:53 PM Post #8
Geek Mod Posts: 9,218 From: Indiana U.S. A. OS: 2000, xp, xp pro, Linux	Hi nondaj, The logs look fine,Just something minor to fix. Also let me know if your still havingthe e-mail problem Please download DAFT and save it to your desktop: Double-click the daft.exe icon. Click on the Scan button. Select everything it is displaying there Click the Fix button. Then rescan with DAFT again - it should say now that "All associations are OK" Close DAFT if you receive that message. This means that it is fixed now. Next Please Download GMER from here: http://www.gmer.net/files.php Unzip it to the desktop. Open the program and click on the Rootkit tab. Make sure all the boxes on the right of the screen are checked, EXCEPT for ‘Show All’. Click on Scan. When the scan has run click Copy and paste the results (if any) into this thread. Thanks

nondaj View Member Profile	May 20 2008, 05:51 PM Post #9
Member Posts: 394 OS: XP Pro SP2