12 replies to this topic

[tinpanalley]

Hi, someone had just recently finished helping me a few weeks ago but it didn't really help unfortunately. I seem to have a SPAM email issue. I use Mozilla's Thunderbird for email. Is it true that there is no SPAM software for Thunderbird? Am I out of luck?

Also, there are strange slowdowns in Windows and online. I have defragged, and scanned with many different tools. Here's my logfile... THANK YOU!!

Logfile of HijackThis v1.99.1
Scan saved at 7:31:30 PM, on 8/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\Smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ezSP_Px.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AccuWeatherDesktopAlerts\AccuWeatherDesktopAlerts.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\CTSvcCDA.exe
C:\WINDOWS\runservice.exe
C:\Program Files\MacOpener\FORMATM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\RioMSC.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SmcService] "C:\PROGRA~1\Sygate\SPF\Smc.exe" -startgui
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\system32\mstask.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AccuWeatherDesktopAlerts] C:\Program Files\AccuWeatherDesktopAlerts\AccuWeatherDesktopAlerts.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec....sa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1099665745687
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1163200215953
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec....sa/SymAData.cab
O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} (Seagate SeaTools English Online) - file://D:\webpull\support\disc\ASP\tools\en\bin\npseatools.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: MacFormatService - Unknown owner - C:\Program Files\MacOpener\FORMATM.EXE" /SERVICE (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\Smc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

[ken545]

tinpanalley, Sorry for the delay. You didn't say if your spam issues are incoming or outgoing. I see a clean log with no programs on it that would take over your computer and send spam. As far as incoming, there is nothing we can do on this end, you need to just install a good spam filter. Almost 99% of the time if you use your email to sign up for something you will start getting spam. Its really a menace. What I do is to have about 3 free web based email addresses from either Hotmail, Google, Yahoo. Pick a user name that is hard for them to copy with underscores and spell words incorrectly. Example Douhgunt_12@isp.com (Doughnut} I use each of mine for different things, one for personal for friends and family, one for just signing up for different things and one for work. If one gets overwhelmed, I just cancel it and open another free one. Don't ever reply to a spam email wanting to get off the list or you will get on a bigger list. Don't open them, just mark them as junk and delete them. Hope this helps Ken

[tinpanalley]

Hey Ken, Thanks for the reply. You're right, I didn't mention whether the spam was incoming or outgoing because I wasn't aware there were two kinds. It is incoming and it still happens. I'm using Thunderbird for email. What spam program will work with that? All I see everywhere is programs for Outlook, Eudora, etc. But none for Thunderbird. If Thunderbird is all I need, can you tell me how to set it up to start filtering all this spam? Finally, is this really the only solution? There's really NO other way to eliminate spam? I understand it happens because someone's got my email address so it's not something I can control from within my system, but I'm surprised no remedy other than a spam program has been developed. Anyway, I really appreciate your reply. If you could just help me out with the above questions, I'm sure I'll be fine. Thanks!

[ken545]

What your saying about it being a pain is an understatement. I use Thunderbird mail also and you can create filters. It would be best if you read these articles and you can learn to set up the filters.

Once you even register a product like say a printer , you get on a list, if you except mail from 3rd parties sometimes they will sell the list and it goes on and on and on. Think about it. A spammer sends out a million emails a day for some bogus pill that you and I know won't work, but some people will take the bait and buy it. Out of that 1 million, even if only 1% of people bought it at say $29.95 , thats a ton of money. They just arrested a guy who was one of the kings of spam and in the past few years he made something like 16 Million.

http://www.mozilla.o...erbird/faq.html

Thunderbird is part of Mozilla that was once Netscape so they work the same.
http://developer.moz...th_Netscape_7.1

Your call but you can give this a try, they offer a free and paid version and also a trial.
http://www.mailwasher.net/


Ken

[tinpanalley]

Hey again, Thanks for the info. But, I'm afraid I'm a bit lost. I followed that Netscape tutorial and I think I set up the filter properly, but how do I know if it's "on"? I mean, what tells me that it's activated? Do you see what I mean?

[ken545]

Good Morning,

First off make sure your using the latest version of Thunderbird 1.5.0.13. Go to Help> About and see what version you have. If you need to update go to Help> Check for Updates.

Always mark spam as Junk, Thunderbird remembers this. Then go to Tools> Junk Mail Control> Adaptive Filter and make sure Enable Adaptive Junk Mail Detection is Enabled.

Ken

[tinpanalley]

See, that's the thing. The latest version of Thunderbird is 2.0.0.6 not 1.5.0.13 and none of the options you describe are there. That's why I'm confused. Thanks!

Edited by tinpanalley, 12 September 2007 - 08:20 AM.

[ken545]

Hello,

1.5.0.13 <-- This is the latest update for the 1.5 version, I was unaware that you had version 2. The same setting are available in Thunderbird 2 as they are in 1.5, just laid out differently.

Open up Tools> Account Setting > Junk Setting and make sure that "ENABLE ADAPTIVE JUNK MAIL CONTROLS FOR THIS ACCOUNT" is checked.

When you get spam, you need to mark it as so and it will train the filters to look out for them. It takes some time for the filters to get trained.

[tinpanalley]

Thanks, man. Now, last question: when it starts to recognize the spam, will it simply stop those emails from entering my inbox automatically as they arrive? I know I can set them to delete or dump in a junk box, but what I'm trying to figure out is if they'll go there instantly once it recognizes the spam. Thanks

[ken545]

Yes they will, I have mine set to auto delete them. Like I said it will take awhile for the filters to be trained. You can also go to Tools> Message Filters and add any offensive email addresses that you don't want to get, example, I have one gal I work with was constantly sending me jokes, you know the kind that goes out to 50 email addresses, after the third time of asking her not to send them, I finally added her email address to my filters and I no longer get any emails from her. You need to play around with it, read some tutorials ( do a Google search for Thunderbird email tutorials) and you will learn as you go / Good Luck. Ken

[tinpanalley]

Thanks so much. You've been a huge help. I really appreciate it! Take care, Phil

[ken545]

Your very welcome Phil.

• How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
• Tutorial for System Restore <-- Do this first to prevent yourself from being reinfected.
• Tom Coyote
• TonyKlein CastleCops
• Grinler BleepingComputer
• Geeks To Go
• Dslreports

Safe Surfn
Ken

[ken545]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.