BleepingComputer.com: My computer's sending spam! ACK!

Jump to content

Forum Guidelines

Posted Image Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help


Posted Image Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.


Posted Image DO NOT RUN ComboFix unless requested to.


Posted Image Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.


Posted Image When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.


Posted Image Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  • 2 Pages +
  • 1
  • 2
  • You cannot start a new topic
  • This topic is locked

My computer's sending spam! ACK! My computer is sending spam from my yahoo account.

#16 User is offline   lintlicker 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 15
  • Joined: 21-April 09

Posted 23 November 2011 - 11:09 AM

Xpud loads fine (interesting program) but it does not recognize my usb drive. Under mnt I only see sda1 and sda2. These folders have files from my hard drive in them. While loading, Xpud reports some errors, but they flash by so fast I cannot read them. I'm going to try to download the testdisk while logged in to xpud.

This is awful. Thank you for your patience.

#17 User is offline   lintlicker 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 15
  • Joined: 21-April 09

Posted 23 November 2011 - 11:38 AM

Due to some weird errors while booting xpud, the xpud environment would not recognize my usb. I installed the testdisk software on my C drive as an attempt to work around this. It may have worked. Oddly enough, the testdisk software recognized the usb. Upon restarting, I get Windows boot manager.

Windows failed to start. A recent hardware or software change might be the cause. To fix the problem: need windows installation disk.

::options::

File \windows\system32\winload.exe

Status: 0xc000000e

Info: the selected entry could not be loaded because the application is missing or corrupt





crap

#18 User is offline   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,114
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 23 November 2011 - 06:57 PM

That winload error can be fixed with a command prompt command but let's stay within xPUD for now.

Okay, the USB problem is often dealt with by unplugging and then plugging in the flashdrive whilst in xPUD.

If that fails you can set up xPUD using a CD.

Download GETxPUD.exe to the desktop of your clean computer
  • Run GETxPUD.exe
  • A new folder will appear on the desktop.
  • Open the GETxPUD folder and click on the get&burn.bat
  • The program will download xpud_0.9.2.iso, and upon finished will open BurnCDCC ready to burn the image.
  • Click on Start and follow the prompts to burn the image to a CD.

If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#19 User is offline   lintlicker 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 15
  • Joined: 21-April 09

Posted 23 November 2011 - 10:56 PM

Ok, unplugging and replugging in usb = win
restarting computer = fail
same error as before.

I was able to run everything from the usb, so that's good, right?

Same error as before though.

#20 User is offline   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,114
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 24 November 2011 - 08:29 PM

Do you have your Vista disk?
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#21 User is offline   lintlicker 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 15
  • Joined: 21-April 09

Posted 25 November 2011 - 07:00 AM

No. :(

#22 User is offline   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,114
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 25 November 2011 - 07:48 PM

The winload problem becomes more difficult if you are unable to attempt to fix the boot in the recovery environment. Also, a lot of these problems are starting to look like hardware and less like malware.

However, there are still symptoms of infection that I have to try and investigate so let's see if you can burn a recovery disk.


Download the recovery disk for your Vista from NeoSmart here.

Straightforward instructions (if you need them)

Locate your Vista disk.

If your PC is not booting from the CD, you need to change the boot order:
  • Restart your PC
  • As soon as you get an image, press the Setup key. This is usually F2, or Del. On some machines the key can also be a different one. It should, however, be stated on the screen which key is the setup key.
  • Once you enter the computer's BIOS, use the arrow keys and tab key to move between elements. Press enter to select an item to change.
  • Navigate to the tab, where you can set the boot order. It should be called Boot or Boot order
  • The tab should now show your current boot order.
    If the CD-drive is not at the top, please navigate to the CD-Rom drive with the keys arrows. Then move it to the top of the list. The keys for switching boot position are usually + to move up and - to move down. However they can be different, but they should be stated in the help, so that you can find them easily.
  • Once the CD-drive is on top of the boot order, navigate to Exit and select Exit saving changes.
  • Your PC should now boot from your CD.
    Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted.



  • Select your Vista Install from the list in Windows Boot Manager

    · Microsoft Vista Setup (x86)
    · Microsoft Vista Setup (x64)


  • Press enter.

  • You will then see Windows is Loading Files.

  • Next, the Language Screen will come up. Since you have already selected this option when you installed Vista, just click on Next.

  • Now you will see the Vista Installation Screen.

    DO NOT CHOOSE Install Now

    Instead, towards the bottom left of the window you will see.

    · What to know before installing Windows

    · Repair your Computer

    Choose and click on Repair your Computer

  • Select "1" Startup repair

Exit the recovery console, reboot your PC and then, if you can, run MBRCheck and post the log.
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#23 User is offline   lintlicker 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 15
  • Joined: 21-April 09

Posted 27 November 2011 - 10:51 PM

I've been debating to myself about trying a linux operating system. Using xpud in a way pushed me off the diving board. If I switch to linux, will this avoid the malware issues? I assume that linux and windows work in fundamentally different ways, so an infected windows should not affect linux.

I only bring this up because if switching operating systems will avoid the problem, then I think I might just switch to linux.

What kind of hardware issues are you suspecting? Everything seems to operate correctly except for the whole spam thing.

What do you think? Thank you for your help through this. I appreciate your time and effort.

#24 User is offline   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,114
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 28 November 2011 - 07:21 PM

Quote

I've been debating to myself about trying a linux operating system


Linux is a very different operating system and takes a lot of getting used to. What I would say is that these spam-sending incidents tend to be a one-off and the machine is often not badly infected. If you would feel better then a reinstall would be an option but I would not recommend it based on what happened. You are right, of course, that malware isn't known in any quantity or quality in Linux so it does have that going for it.

The malware part of this topic seems to be under control so why not post in the Linux forum and see what other like-minded Distroheads have to say.

Any other questions before we finish up?
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

#25 User is offline   lintlicker 

  • Member
  • PipPip
  • Find Topics
  • Group: Members
  • Posts: 15
  • Joined: 21-April 09

Posted 29 November 2011 - 05:14 PM

I've been playing around with the demo of ubuntu and reading a lot of guides, and I have to admit that I'm pretty impressed. The speed and ease of use is pretty incredible. I'm actually typing this post on my windows-compromised/broken machine using a usb ubuntu trial. Regardless whether or not I fix windows, I think I'm going to make the switch. I wanted to run the idea by you since you've already invested so much time into this problem. I don't want to blow you off or insult you, but if just switching to linux will avoid the problem, I think that it is the path of least resistance.

So if this solution will work, I think this is the way I'll go. Thank you so much for your help.

#26 User is offline   m0le 

  • I know the drill!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Instructor
  • Posts: 29,114
  • Joined: 24-July 08
  • Gender:Male
  • Location:London, UK

Posted 29 November 2011 - 05:53 PM

No insult taken. Linux is a fine resolution and as we have said here many times the best way to remove malware is to reformat and reinstall. Ubuntu is a very good user-friendly option, so good luck.

I am closing this topic :)
If I have helped you fix your PC then please donate. Thanks

Posted Image
m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)

Share this topic:


  • 2 Pages +
  • 1
  • 2
  • You cannot start a new topic
  • This topic is locked

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users