Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Replicating Email


  • Please log in to reply
6 replies to this topic

#1 Glendon

Glendon

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:44 PM

Posted 13 October 2012 - 06:48 AM

Hello, this is my first post on bleeping computer, so I hope I have the right forum!

I have an email supposedly from PayPal that says I have changed my PayPal email address. I knew this was bogus and it went into the delete folder. Now it keeps replicating itself and I can't permanently delete it. When I do, it comes back (actually there are four entries at a time) and as time goes by it keeps multiplying. I have tried to delete it via the Windows explorer route as well as within Windows Live Mail, but it keeps coming back and multiplying. Initially ZoneAlarm was "treating it", but now it no longer flags it. At the beginning I could read the contents (without opening the attachment), but now all I have is the header, yet it keeps coming back.

I have tried running rkill.com and then Malwarebytes from the Safe Mode (as suggested by the ZoneAlarm support line), but it does not detect any malware, yet it would seem to be some kind of virus or the like. Does anyone have any suggestions?

Thanks

BC AdBot (Login to Remove)

 


#2 Glendon

Glendon
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:44 PM

Posted 15 October 2012 - 01:16 AM

As an update to my previous post - the contents are now back (not sure why they went away) and are as follows (there is an attachment that I haven't opened):


Dear PayPal Customer,



You have added xxxxxxxxxxxxxxxx as a new email address for your Paypal account.

If you did not authorize this change, check with family members and others who may have access to your account first. If you still feel that an unauthorized person has changed your email, submit the form attached to your email in order to keep your original email and restore your Paypal account.

NOTE: The form needs to be opened in a modern browser which has javascript enabled (ex: Internet Explorer 7, Firefox 3, Safari 3, Opera 9)

Please understand that this is a security measure intended to help protect you and your account. We apologize for any inconvenience.

If you choose to ignore our request, you leave us no choice but to temporary suspend your account.



Sincerely, PayPal Account Review Department.


--------------------------------------------------------------------------------

Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your PayPal account and choose the "Help" link in the footer of any page.


[Moderator edit and note: removed address to avoid its being harvested by spambots. jgw]

Edited by jgweed, 15 October 2012 - 09:04 AM.


#3 Glendon

Glendon
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:44 PM

Posted 22 October 2012 - 05:27 PM

Well after praying about it, I decided to uninstall my antivirus program (ZoneAlarm) and to install the free Microsoft Essentials Security program and see if that may help. It didn't pick anything up but the problem of the replicating emails went away. I have since uninstalled MES and reinstalled ZoneAlarm and the problem is still gone. Initially ZoneAlarm identified the offending email as containing a virus/trojan (though later on it stopped flagging it as such)and although treating it, somehow it kept putting it back x4 into my email deleted folder on a regular basis. How this occurs I don't know, but the problem is now gone :)

Thanks to all who read this and pondered a solution.

#4 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:10:44 PM

Posted 22 October 2012 - 06:28 PM

Hello -
First -
What email are you with, and can you change the Password on it ?? Also if you do have a Paypal Account, change the password on that ??
Next -
It is not an infection
, but a continuing Spam email - You have been placed on a Spam list and these will continue, unless you cancel or alter your passwords -
Do you have a SPAM folder with your emails ? Send these there and just delete them if they continue - Never reply -
I get about 10 or more per day to say I have won a million dollars, please send my contact details to xxxxxxxxxxxxxxxxxxx
There is also a poor lady in "India" that wants help (but she has a computer), and these arrive every 2 days - Plus the man that wants to do a business deal Etc Etc

All these are re-directed to my Yahoo Spam folder and never appear as real emails now -

There is very little you can do except the above - Just to be sure run these scans >>
Download, install and Update SuperantiSpyware Free and run a full scan -
Post the log back here -

Download Adware Cleaner run it as admin Click the Delete button allow it to run and post the log it creates.
AdWare Cleaner


#5 Glendon

Glendon
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:10:44 PM

Posted 22 October 2012 - 06:48 PM

Thanks for your input and I can understand why you thought it was repeated spam email.

However I don't believe that was the case for a few reasons. Firstly, it always appeared in my Deleted folder in multiples of four, and they all had the same date and time stamp. Secondly, I had tried deleting them via Windows Live Mail, but I also deleted them by digging through to the offending emails using Windows Explorer. In doing this, and rebooting the computer the offending emails would return in the folder without me ever opening the Email program, so it could not have been a Spam email being re-downloaded. Thirdly, I usually use Mailwasher to examine incoming mail and to delete spam and other suspect mail before downloading it onto my computer (obviously the one that began to be replicated slipped through back in May), however I would generally see if I am receiving repeated spam emails.

As I mentioned, for whatever reason, it seems that ZoneAlarm kept wanting to put it back in multiples of four.

#6 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:10:44 PM

Posted 22 October 2012 - 08:04 PM

Hi -
As I noted above you can change your passwords to be sure of this. Also your PayPal password just to be sure -

Run the 2 scans I left above and then run ESET OnlineScanner (this may take up to 2 hours for your first time)
You may be prompted to disable any antivirus programs for this to run -
Download ESET online Scanner - This will take a while to load the base program and then the updated definitions
Post back if it finds any infections -

Once you have finished All of those scans download TFC Cleaner (TempFileCleaner) and this may remove any parts that are left -
Re-run it once a week -

Clean out your temporary internet files and temp files.
Download TFC by OldTimer http://oldtimer.geekstogo.com/TFC.exe to your desktop.
Double-click TFC.exe to run it.
Note: If you are running on Vista, right-click on the file and choose Run As Administrator
TFC will close all programs when run, so make sure you have saved all your work before you begin* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.

Thank You -

#7 Terran69

Terran69

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:10:44 PM

Posted 18 December 2012 - 11:04 PM

Hey Glendon

I have just resolved a similar issue as you, doing same as what you said.

I was getting a spam email from Western Union replicating in my Deleted folder. Zone alarm would detect & treat it noting infection; HEUR:Trojan.Win32.Generic

But when restarting PC and re-opening Windows Mail it returns & multiplies continually for as long as I have email open (ie could be 1000s before I realise) Just emptying the deleted folder removes them momentarily, but it just starts all over again almost immed.

I ran a number of different Malware programs also with no detections. Has been going on for months.

Came across this thread and did same as you. Uninstalled Zone Alarm Extreme Security and installed Microsoft Security Essentials. What do you know,, its fixed.

Seems some issue with Zone Alarm.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users