Hotmail sending spam emails

Hi Cypher

Restarted machine. turned on firefox - it loads to the default mozilla start page. opened a new tab and tried surfing to the globe site - no joy.

perhaps once we get rid of the infection found in the kaspersky scan both of these problems will go away. (he says hopefully )

Hi.
What the kaspersky scan found is not a problem.
When you open a new tab is the globe site the only site you can't get to?
Try this then let me know how FF is performing.

Reset FireFox:

• Click on Start > All programs > Accessories > Run.
• Enter the following command:
  

  firefox.exe -safe-mode

• In the open window, select Reset all preferences to default Firefox.
• Click on Make the changes and restart.
• After FireFox restarts click on Check for Updates...

Hi Cypher

ran as suggested above. No change. and yes - the only page I'm having a problem with is the main page on the globeandmail. Ran through other bookmarks and found no problems. Weird.

Hi.
Thats odd indeed.
Can you give me an update on the spam emails have any more been sent?

Re: any more spam emails

I just placed a call to one of the people on my contact list asking the question. will provide an update as soon as get call back. I will note that i have NOT turned windows live mail on since the other day when you suggested that i change password, which i did by logging into hotmail on the web. (have not logged into hotmail thru that pathway either)

Ok no problem give me an update on the spam emails when ready.

just got the callback - no spam emails. however, not sure if that means anything because i have NOT updated windows live mail for the new and improved password.

Hi.
Your latest logs appear to be clean.
Go ahead and start using your email for a day or two then let me know if anymore spam is sent.

Hi Cypher

well...an hour in and no spam emails sent (so far).

The irritating "new startup" notice from Winpatrol continues to pop up. when i select No, it tells me that:
This setting is in a key location for your operating system. We do not recommend removal unless you are absolutely sure this entry is causing a problem.
Are you sure you want this removed?

When I select yes, it then opens up the following page:
file:///C:/Program%20Files/BillP%20Studios/WinPatrol/helpme.html

When I look at the list of active tasks I don't anything that is immediately obvious as the culprit so i have not selected any tasks for the "kill task" function.

Also - globeandmail home page is still a problem. I CAN get to a normal looking G&M home page on another computer though.

Hi Zaphod.
The next time the winpatrol alert pops up click yes or allow and let me know what happens.

Hi Cypher

Well – it’s been 2 days and NO SPAM emails!! Thank you very much!!!! I really appreciate your help cleaning this up. My laptop appears to be working properly again. What a relief.

A couple of final items/questions:

On the Winpatrol issue, I clicked yes as suggested and have had no recurrence of the irritating popup. 

On the globeandmail home page issue – was still a problem on Thursday but seemed to clear itself up on its own yesterday. Still not clear what was happening there, but since its gone away I won’t worry about it.

When we ran the kaspersky scan on Wednesday it identified:
Threats found: 1
Infected objects found: 2
Suspicious objects found: 0
Scan duration: 04:15:56

File name / Threat / Threats count
C:\Program Files\HP Games\Wheel of Fortune\Wheel of Fortune-WT.exe Infected: Trojan-Mailfinder.Win32.Blen.ys 1
C:\SwSetup\HPGame\games\wheeloffortune-setup.exe Infected: Trojan-Mailfinder.Win32.Blen.ys 1

You then said:
What the kaspersky scan found is not a problem.

I’m bringing this one up again for the following reason – the laptop is an HP machine. There has always been a weekly check (runs on Mondays). Over the last couple of weeks, on more than one occasion (and not necessarily on Monday) it identified that a software update for the Realtek High-Definition Audio was suggested (as routine). I accepted it, but the update has not been successful to-date.

So I’m just wondering if these items may be related.

Finally, I took a look at the Malware Removal - Downloads Page.

One of the suggested items is the mvps Hosts program. I have been attempting to follow the Vista instructions
http://www.mvps.org/winhelp2002/hostsvista.htm
but having no success:

In the 1st option (sendto), I get to “Next: Right-click in the right pane and select: New > shortcut , but then there is no “next dialogue box”. So I get stuck here.

When I try the ‘Updating the HOSTS file via "Elevated" Command Prompt” option, every time I attempt to save the cmd-admin.reg file, it only allows me to save as a text file – so don’t get the option to “right-click and select: Merge (Ok the prompt) ... no need to reboot.”

While I’m certainly not a techie, I am a fairly sophisticated user and am getting a tad frustrated with my inability to perform this (apparently simple) task.

What am I missing here?

Thanks once again for your assistance Cypher

Hi Zaphod.

Well – it’s been 2 days and NO SPAM emails!! Thank you very much!!!! I really appreciate your help cleaning this up. My laptop appears to be working properly again.

Good news and you're welcome.

You then said:
What the kaspersky scan found is not a problem.

Yes those two files are ok it was a false positive detection by the KAS scan.

One of the suggested items is the mvps Hosts program. I have been attempting to follow the Vista instructions

See if This Link helps.

your latest set of logs appear to be clean!
This is my general post for when your logs show no more signs of malware.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Time for some housekeeping

• Click on Start > All programs > Accessories > Run.
• Now type in ComboFix /Uninstall into the box and click OK.
• Note the space between the X and the /Uninstall, it needs to be there.
  

The above procedure will reset your System Restore and clear out the backups and quarantines created during the course of this fix.

Next

OTC

Download OTC by Old Timer and save it to your Desktop. This tool will remove all the tools we used to clean your pc.

• Right-click OTC.exe And select " Run as administrator " to run it.
• Click the CleanUp! button
• Select Yes when the Begin cleanup Process? Prompt appears
• If you are prompted to Reboot during the cleanup, select Yes
• The tool will delete itself once it finishes, if not delete it by yourself

Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.

You can now delete any tools we used if they remain on your Desktop.

Protection Programs
Don't forget to re-enable any protection programs we disabled during your fix.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Microsoft Windows Update
Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office products loopholes and fix any bugs found. Install the updates immediately if they are found.
To update Windows
Go to Start > All Programs > Windows Update > Check for updates.
To update Office
Open up any Office program.
Go to Help > Check for Updates

I would be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Safe surfing!

Hi Cypher

got your message and ran through the various links.

fyi - i ended up doing the simple copy and paste on the hosts file - i'm assuming that is all i need to do on a regular basis in order to keep this up to date.

the combofix /uninstall did NOT work. generated the following message:
Windows cannot find "combofix'. make sure you typed the name correctly and then try again

once again THANK YOU VERY MUCH

Have a great day!
Zaphod

Hi Zaphod.

"Zaphod" wrote:once again THANK YOU VERY MUCH

You're most welcome.

No problem delete Combofix manually....
Delete Combofix Qoobox folders and Combofix.txt file from C:
Delete Combofix from your desktop.

Any other questions before i close this topic?

combofix now gone

no more questions. feel free to close the topic.

have a great day!