Solved

Computer is trying to send out many many emails.  Norton System Works is providing a message:  "Your email message was unable to be sent because your mail server rejected the message"

Posted on 2006-07-19
8
408 Views
Last Modified: 2013-12-04
I too am having an issue similar to the one posted on 7/13/06.  Symantec warning: "Your email message was unable to be sent because your mail server rejected the message".

There are a series of boxes which appear - each with a different number of out-going emails.  The other odd thing is that the internet is very active, and the network shows our computer is receiving information (we have no other updates or active downloads).

Some show 207, 1021, 68.  The numbers appear random.  These appear to beoutgoing emails to what seems random users are "trying to be sent out".  Many have a yahoo address.  Symantec appears to error-out with messages saying "Your email message was unable to be sent because your mail server rejected the message".

I am running Windows XP pro sp2 and my email client is MS Outlook Express.  I'm using 2006 Norton SystemWorks 2006 .  I am seeking a solution to find the cause of this bugger.

I've unstalled Norton System Works 2006 and reinstalled (thinking the NSW was compromised).  This did not resolve the issue.  

I've also loaded Microsoft's Defender (Beta 2) x86 and the Microsoft Windows Malicious Software Removal Tool (KB890830).  Both reported no errors of problems with our system.
0
Comment
Question by:jfolgert
  • 3
  • 2
8 Comments
 
LVL 32

Accepted Solution

by:
r-k earned 500 total points
ID: 17142215
Please post the HJT log as follows:

Download and run HijackThis from http://www.hijackthis.de/
Copy-and-paste the resulting log back to that same web site (not here)
Click on "Analyze", and then click on "Save Analysis" at the bottom of the next page.
Finally post a link here to the saved analyzed page.

If you want to try something in addition, then get the free trial version of Ewido from http://www.ewido.net/ and scan your system (do the "Update" first to update the defs before scanning).
0
 

Author Comment

by:jfolgert
ID: 17142522
Thanks r-k

I spent the day researching options to get our system back to a stable state.  I could not find a great deal of explinations specific to the problem.

Thanks for your suggestions.

Through numerous tests, I found the problem to be the following:

PdPinch.b  trojan  (with 3 objects on the system), combined with the Avalon-Spammer trojan.

they have been removed and this appears to have solved the issue.  (4 hours strong, and still going).



Thank you

0
 
LVL 32

Expert Comment

by:r-k
ID: 17142541
That's great. You may want to run Ewido anyway, in case something got left behind.

Another good option at this point is to do an online scan at: http://safety.live.com/site/en-us/default.htm
It takes a while so do it when you have idle time for a couple of hours, but it's fairly complete.
0
Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 

Author Comment

by:jfolgert
ID: 17142862
Thanks for comments,

This was a frustrating issue.  I'll keep an eye on activity and report any issues if they arise again.   I tested a few trojan/virus seaching programs (did not try Ewido  yet (thanks  r-k !) nor the on-line link you provided - but hope to soon).  

The app. that found and apparently erraticated the issue was CounterSpy 1.5.  We'll see if the problem returns.  I'd like to find the source.  We exchange mapping / GIS data often. We also have Semantic / Norton System Works 2006 which did not find the issue.


Thank you

 

0
 
LVL 32

Expert Comment

by:r-k
ID: 17142897
"I'd like to find the source"

The most likely reason for such infections is one of the following:

(1) System not patched with latest Windows updates.
(2) Easy to hack passwords (avoid common names and dictionary words)
(3) Windows firewall not enabled
(4) Someone clicked on an email link or attachment
(5) Someone clicked on the wrong web pop-up.

I'm not too surprised Norton did not catch it, there are whole classes of malware it can't find. In addition to Norton, I would suggest installing Windows Defender on your XP workstations http://www.microsoft.com/athome/security/spyware/software/default.mspx It is free and quite effective against spyware/malware.
0
 

Expert Comment

by:mcdougp
ID: 17151110
My laptop had the exact virus.  The virus attaches itself to Norton's ccApp.exe rendering NAV useless (unless you turn off email scanning).  Uninstalling & re-installing NAV won't fix it and forget about Windows Defender as it won't detect it either.  The virus is actually classified as a Trojan (exact name I forgot) and was easily removed by downloading the 30 day trial of F-Secure http://www.f-secure.com/home_user/support_and_downloads/evaluations/

PS.  I became infected by executing a download from the P2P network (evil shit).  That's the risk you take ;^)

Hope I've been of some assistance...

Paul
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many of us in IT utilize a combination of roaming profiles and folder redirection to ensure user information carries over from one workstation to another; in my environment, it was to enable virtualization without needing a separate desktop for each…
The term "Bad USB" is a buzz word that is usually used when talking about attacks on computer systems that involve USB devices. In this article, I will show what possibilities modern windows systems (win8.x and win10) offer to fight these attacks wi…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
I've attached the XLSM Excel spreadsheet I used in the video and also text files containing the macros used below. https://filedb.experts-exchange.com/incoming/2017/03_w12/1151775/Permutations.txt https://filedb.experts-exchange.com/incoming/201…

679 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question