Avast WEBforum

Other => Viruses and worms => Topic started by: galien8 on May 24, 2012, 11:22:56 PM

Title: Suddenly unknown POP3 SMTP ztomy.com SSL servers avast warning by OUTLOOK.EXE
Post by: galien8 on May 24, 2012, 11:22:56 PM
L.S.

To my knowledge I never used ztomy.com. However I used SMTP mail.strawberry.arvixe.com from ASP.NET for a website I am programming under localhost, thats mentioned as 50.61.238.128 in the avast Email Shield SSL
settings.

Am I hacked? Or is it a virus?

PLEASE HELP!

Johan.
Title: Re: Suddenly unknown POP3 SMTP ztomy.com SSL servers avast warning by OUTLOOK.EXE
Post by: mchain on May 25, 2012, 05:16:26 AM
Hi galien8,

If you could attach a .jpeg, .gif, or .png of the box or warning in question, others would see what you are seeing, and thus be able to help.

Use "Attachments and other options" in the box you are writing in, lower left hand corner of forum text box, to attach.  Note the forum size limit.

Text will work as well.
Title: Re: Suddenly unknown POP3 SMTP ztomy.com SSL servers avast warning by OUTLOOK.EXE
Post by: DavidR on May 25, 2012, 02:43:49 PM
Many ISP, etc. use third party services to handle their email services, I just wonder if it is something like that. How to check it is probably going to be hard short of asking your ISP, etc. if they use an email service provider for their emails and hope they tell you if they do.

I have a BT Internet email address and despite BT Internet being the email server address it is actually handled by Yahoo.com and that is what I see in the avastUI, Mail Shield, SSL Accounts, no entries for BT Internet.

However that said, that site doesn't have a good reputation, http://www.mywot.com/en/scorecard/ztomy.com (http://www.mywot.com/en/scorecard/ztomy.com)
Title: Re: Suddenly unknown POP3 SMTP ztomy.com SSL servers avast warning by OUTLOOK.EXE
Post by: galien8 on May 25, 2012, 05:53:22 PM
Hi Mchain,

I do not have the warning because once clicked away it does not come back. But I attach the SSL Settings screenshot.

Thanks for your reply!

Kind regards,

Johan.
Title: Re: Suddenly unknown POP3 SMTP ztomy.com SSL servers avast warning by OUTLOOK.EXE
Post by: mchain on May 25, 2012, 06:03:26 PM
Well, Securi site check shows ztomy.com has problems.

Here:  http://sitecheck.sucuri.net/results/www.ztomy.com (http://sitecheck.sucuri.net/results/www.ztomy.com)

As for providing help in resolving your issue, I will defer to others here more qualified than I.  You are saying ztomy.com should not be there?

It's possible at times to recover the warning box by right-clicking the avast icon in system tray and selecting 'Show last pop-up'.
Title: Re: Suddenly unknown POP3 SMTP ztomy.com SSL servers avast warning by OUTLOOK.EXE
Post by: DavidR on May 25, 2012, 07:22:09 PM
Given the sites history, it would be worth checking that you don't have a hidden/undetected emailbot and aren't sending out spam. First set the Email Shield, Expert Settings, Sensitivity, Heuristics sensitivity to High.

- This needs further analysis by a malware removal specialist:
Go to this topic http://forum.avast.com/index.php?topic=53253.0 (http://forum.avast.com/index.php?topic=53253.0) for information on Logs to assist in cleaning malware. Use the information about getting and using the tools and start your own new topic and attach the logs there, not in the LOGS topic.
Title: Re: Suddenly unknown POP3 SMTP ztomy.com SSL servers avast warning by OUTLOOK.EXE
Post by: galien8 on May 26, 2012, 12:27:15 AM
L.S.

Thanks to you all for your help. Since I am now aware it might be a serious problem:

I am going to do the ultimate solution: format C: and D: => completely rebuild the machine. My backups are clean!

Kind regards,

Johan.
Title: Re: Suddenly unknown POP3 SMTP ztomy.com SSL servers avast warning by OUTLOOK.EXE
Post by: DavidR on May 26, 2012, 02:00:58 AM
You're welcome, though I would have taken a shot at at least producing the logs so a malware removal specialist could take a look at them. Unless by your backups, you mean a hard disk image backup.

I use hard disk imaging software (weekly backup image) as my means of disaster recovery (no matter what the cause) so I don't have to go down the format and reinstall route.
Title: Re: Suddenly unknown POP3 SMTP ztomy.com SSL servers avast warning by OUTLOOK.EXE
Post by: mchain on May 26, 2012, 07:10:32 PM
You're welcome, though I would have taken a shot at at least producing the logs so a malware removal specialist could take a look at them. Unless by your backups, you mean a hard disk image backup.

I use hard disk imaging software (weekly backup image) as my means of disaster recovery (no matter what the cause) so I don't have to go down the format and reinstall route.
+1

Might want to check your router or dsl modem for changes/infections as well.