10 replies to this topic

[Hello Everybody]

I am receiving multiple (6-12) emails each day which have no Sender, no Receiver, No Subject, Sent = None, and when looking in options, has no Header information (it is blank). My impression is that these are being generated from within the Win XP Pro system, either by Outlook 2003, or an errant application which is sending them directly to Outlook, and not through the POP account. There are no attachments, and their size is listed in the sub KB range (~ 560 B) which seems small for any email to me. All Security updates are current and have been applied. This is not the listed email problem in the MS Knowledge Base, where the body of the email is missing. These emails are completely blank, without even a sent time and date. I cannot filter them out with Outlook, as it does not have a setting I can find to filter email without also restricting BCC mailings (i.e.; I am not listed in the TO: box, etc.). Better yet, I would like to know where these are coming from.

[Micah_6:8]

Read one of them, and go to: View --> Options

Look in the box under Internet Headers. It will have something like this:

Return-Path: <nobody@?.com>
Received: from ?.net ([?.?.?.?]) by ?.net
(InterMail vM.6.01.06.01 201-2131-130-101-20060113) with ESMTP
id <20060524230230.XOJT20955.?net>
for <?@?.net>; Wed, 24 May 2006 19:02:30 -0400
Received: from ?.com ([?.?.?.?])
by ?.net with IMP
id dAzo1U01F1p5oge0000000
for ?; Wed, 24 May 2006 18:59:50 -0400
Received: from nobody by ? with local (Exim 4.52)
id 1Fj2Q5-00070C-Bl
for ?; Wed, 24 May 2006 18:05:37 -0500
To: ?
Subject: Topic Subscription Reply Notification ( TomCoyote Forums )
MIME-Version: 1.0
Content-type: text/plain; charset="iso-8859-1"
From: "TomCoyote Forums" <NoReply?TomCoyote.org>
X-Priority: 3
X-Mailer: IPB PHP Mailer
Message-Id: <E1Fj2Q5-00070C-Bl@?.com>
Date: Wed, 24 May 2006 18:05:37 -0500
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - ?.com
X-AntiAbuse: Original Domain - ?.net
X-AntiAbuse: Originator/Caller UID/GID - [99 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - ?.com
X-Source:
X-Source-Args: /usr/local/apache/bin/httpd -DSSL
X-Source-Dir: /
X-NAS-BWL: No match found for 'NoReply?TomCoyote.org' (41 addresses, 0 domains)
X-NAS-Language: English
X-NAS-Bayes: #0: 1.48929E-165; #1: 1
X-NAS-Classification: 0
X-NAS-MessageID: 983
X-NAS-Validation: {B65DB9BE-D1DD-4CFD-8A75-7D390FF8FD17}

Note: I have replaced some of the original info with "?" for anonymity

Article to read to help track SPAM:

Spam Tracking Help

Edited by Micah_6:8, 24 May 2006 - 05:41 PM.

[Hello Everybody]

Thank you for your response. However, I was trying to address this in the original post. There is no content, none, it is blank, the content does not exist. There is no reply info, there is no 'HELO' info, no 'MIME' info, No Subject, etc. there are no words in the Internet Headers box... NO WORDS! I know that sounds goofy, but that is what it is. That is why I don't believe they are actually coming through the Inet, but may be generated from within the system and passed to (or even originating within) Outlook 2003. Here is what I see when I forward the mail: From: Sent: None Subject: As you can see, everything is blank. I have searched the Inet and the MS KB's, and find no reference to this anywhere. It is driving us crazy. We just keep deleting them, all day long.

[Micah_6:8]

Did you look at the Internet header?

[Micah_6:8]

there are no words in the Internet Headers box... NO WORDS

My bad!!!

I'm stumped...

[Micah_6:8]

If you want to post a HijackThis! log in here, I'll take a peek at it to check it for mail worms and such:

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Download HijackThis into this folder.

If required a tutorial is here = Hijackthis Folder Tutorial

Links to Hijack This! v 1.99.1:

Hijack This! (© Merijn) at tools.radiosplace.com

Hijack This! (© Merijn) at spywarewarrior.com

Run it from that folder.
Click "Do a system scan and save a log file".

DO NOT "FIX" ANYTHING WITH IT YET!!!
FIXING THE WRONG THING COULD RENDER YOUR SYSTEM INOPERABLE!!!


Reply to this thread, and "copy/paste" the ENTIRE CONTENTS of the log file into this thread.

[Hello Everybody]

Micah_6:8 -
Thank you for your interest. I am posting the complete HijackIt file, and I am adding attachments with a few screen shots of the actual Deleted Items, the opened email, and the 'View Options' window. I know it sounds crazy, but I am offering them to help explain, and to show you how many are arriving and the frequency.

Logfile of HijackThis v1.99.1
Scan saved at 9:38:27 AM, on 5/26/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Palm\HOTSYNC.EXE
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\WISPTIS.EXE
C:\Program Files\Norton AntiVirus\OPScan.exe
C:\Program Files\Messenger\msmsgs.exe
n:\MJT-Personal\My Downloads\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: IEFriendly Class - {A5483501-070C-41DD-AF44-9BD8864B3015} - C:\Program Files\Httper\httper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Zipclix - {319A68DB-06D0-46DA-9F93-A810D5A70836} - C:\Program Files\Zipclix\zipclix.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Startup: NETWORK, CABLE, DSL.lnk = C:\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\NETWORK, CABLE, DSL.bhf
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1126893955519
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1126893923683
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\System32\HPHipm09.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Attached Thumbnails

• 
• 
• 

[Micah_6:8]

Not anything serious in the log....

This:

O2 - BHO: IEFriendly Class - {A5483501-070C-41DD-AF44-9BD8864B3015} - C:\Program Files\Httper\httper.dll

Is:

Httper Adware

This:

O3 - Toolbar: Zipclix - {319A68DB-06D0-46DA-9F93-A810D5A70836} - C:\Program Files\Zipclix\zipclix.dll

Is:

ZipClix Adware

This:

O4 - Startup: PowerReg SchedulerV2.exe

Is a waste of resources.

I would suggest this:

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O2 - BHO: IEFriendly Class - {A5483501-070C-41DD-AF44-9BD8864B3015} - C:\Program Files\Httper\httper.dll

O3 - Toolbar: Zipclix - {319A68DB-06D0-46DA-9F93-A810D5A70836} - C:\Program Files\Zipclix\zipclix.dll

O4 - Startup: PowerReg SchedulerV2.exe

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe

Then click "Fix checked" and close Hijack This!.

Reboot in "safe" mode.

Delete all of the following noted (in red) file(s)/FOLDER(s) you can find:

c:\program files\httper <--- FOLDER

c:\program files\zipclix <--- FOLDER

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread.

I do not think the emails are being generated from within, but we can "dig deeper" if you really want.

[Hello Everybody]

Thank you Micah_6:8 - I will give this a try. I am not at the location of this machine at the moment, and so there will be a few days before I can give a response. One thing I could kick myself for not thinking of until I was away from the machine, is disconnecting the system from the Internet to watch for the same emails. This shouldn't be too difficult, as the period of arrival is fairly predictable due to the repeating pattern. Is there any fairly common application that you know of which may send email notices to the client, and for some reason has lost the content of its message. I would assume that there would be another form of warning of malfunction, but I am reaching for anything. Why do you think the emails are not generated from within? Have you heard of anyone being able to generate and send an email without the Internet Header?

[Micah_6:8]

One thing I could kick myself for not thinking of until I was away from the machine, is disconnecting the system from the Internet to watch for the same emails. This shouldn't be too difficult, as the period of arrival is fairly predictable due to the repeating pattern.

Exactly!!!

Just don't run Outlook.

If you need to check your email, most email providers provide email access via Internet Explorer.

Start checking your email with a web browser instead of Outlook for a day or so.

If the emails still appear, that will prove something on your PC ISN'T responsible.

If the emails don't appear (until you run Outlook), that will prove something on your PC IS responsible.

Why do you think the emails are not generated from within?

I get the same kind of email.. Just not so many.

Have you heard of anyone being able to generate and send an email without the Internet Header?

No.. But then I've never looked into it before.

[Hello Everybody]

After much coordinating between machines and available time, I found that although the XP Pro has been updated, the Office Products (of which one of them is, yes, Outlook, had not!) Updating all of the Office 2003 apps on two of the systems reduced the number of emails, and by updating the last, it looks as if the problem has been corrected. Apparently the Security Update of the OS was clashing with the un-Security Updated Office product of Outlook. Micah_6:8, thanks for all of your suggestions.