Spam E-Mails being Sent from my PC (7000+ Today Alone)

[ksav]

It may have been a corrupted sample then... (this is quite common, actually - the attachments gets somehow screwed and arrives in a non-working state).

Do you still have the file? It would be worth a quick look just to make sure...

Thanks
Vlk

Sorry, no.  I've updated all scanners to latest .dat files.  It is worrying though that major anti-virus
vendors can firstly, not identify a known (it was know it was coming) malicious file, and secondly that some updates can get screwed in this fashion leaving the user unprotected...!!

Awil was (admittedly) one of the better ones in this instance.

Cheers

[Vlk]

Sorry, no.  I've updated all scanners to latest .dat files.  It is worrying though that major anti-virus
vendors can firstly, not identify a known (it was know it was coming) malicious file, and secondly that some updates can get screwed in this fashion leaving the user unprotected...!!

Maybe I said it wrong... all I was saying is that the postcard.exe file you got could be screwed (not the AV updates).
That is, the virus sample could have been benign (datamged) and hence no AV detected it (which is, in this case, correct behavior)


Thanks
Vlk

[ksav]

Maybe I said it wrong... all I was saying is that the postcard.exe file you got could be screwed (not the AV updates).
That is, the virus sample could have been benign (datamged) and hence no AV detected it (which is, in this case, correct behavior)


Thanks
Vlk

Ouch, sorry.  No I got rid of the .exe file after trying the various scanners.  I don't like leaving these types of files on any of my machines.


cheers 

[SendDerek]

Sorry it has been so long since the last update.

The issue has not been resolved as of recent mostly due to my inability to work on the machine.  It's the Point Of Sale machine for the store, and we are not able to ring people up without it. 

I installed Comodo Firewall on it and disabled the Avast Mail protection in hopes that I could figure out what was happening through the use of Comodo's logs.  Unfortunately, without much time to configure it, the firewall was blocking important access that is needed for the POS system to work.

I am going to wait for a good load of down time and try and figure it out then.  Also, I got the Qwest redirect page saying that the account is disabled because of this virus.  I quickly lied my way through the page to regain internet access.  I will be really trying to fix this virus today before we get redirected (or worse) again.

I will also be running the blacklight scan when I am given the chance.  I tried to do it once, ran it for about 10 minutes, and had to exit due to customer.

This PC hasn't been re-formatted in a while and we're almost just looking at getting it wiped clean again instead of going through the virus-hunt hassle.  But not yet.

Thank you for all of your support on this.  I will keep you posted with any progress.

[BJ_GeOrgE]

I will also be running the blacklight scan when I am given the chance.  I tried to do it once, ran it for about 10 minutes, and had to exit due to customer.

blackligh in an online rootkit scanner..if u want an easier solution thry this one http://www.trendmicro.com/download/rbuster.asp its an on-demand scanner which doesn't need inernet connection to scan.. u can see pther similar softwares here http://www.geocities.com/dontsurfinthenude/antitrojan.htm

[alanrf]

Vlk, Igor,

this user posted an avast mail log (almost a week ago!)  that appears to show ashDisp.exe as the source of the spam email causing problems.

While I know that you are busy folks I think this demands a response from the avast team.

So ... how about a comment please?

[Lisandro]

Vlk, Igor

Maybe Vojtech is the man 

[SendDerek]

As another update, I have run the backlight program, but it came back with nothing.  I have currently turned the avast mail client back on to see if there has been any mail going through.  For some reason, it seems that it only goes through after 2:00 in the afternoon.  I have also been watching TCPView but nothing has occurred.  As another precaution, I have been watching the comodo firewall logs, but it appears to be nothing out of the ordinary (BTW: Comodo blocks the backlight scan attempt.  You must shut the firewall down first).

Once again, I will keep you guys posted on what is happening.

And as another little detail about it, we noticed it started happening around after the new year and on two computers.  One was a laptop that was connected to the network, and the other was the POS PC.  We have 3 other computers on the same network, but they do not seem to be infected.  These infected PC's also had Norton installed when then attack hit.  The other machines did not.  Since then, these 2 machines have Avast installed now instead.  Norton had popped up about 100+ warning messages and totally froze the system if you can imagine.

Thanks for any help!

[Lisandro]

These infected PC's also had Norton installed when then attack hit.

Do you mean, when you've installed avast?
Disabling Norton is not enough to avoid conflicts with avast...  :'(
Please, follow: http://forum.avast.com/index.php?topic=23089.msg211543#msg211543

[SendDerek]

These infected PC's also had Norton installed when then attack hit.

Do you mean, when you've installed avast?
Disabling Norton is not enough to avoid conflicts with avast...  :'(
Please, follow: http://forum.avast.com/index.php?topic=23089.msg211543#msg211543

Oh, I know better than that. lol 

Norton was totally uninstalled before I installed Avast.  I just meant that Norton was the AV installed at the time of attack.  I installed Avast in hopes that Avast would take care of it better than Norton.  And, it did detect a bunch of new viruses, but not the particular one that we're trying to find.

[Vlk]

If it's the ashDisp.exe process that seems to be sending out the emails it may be because there's a rogue DLL loaded into its address space.

Please try doing the following: download Process Explorer from http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx, simulate the problem (i.e. confirm the ashDisp.exe process is sending out emails), then run Process Explorer, scroll the process tree to ashDisp.exe, press Ctrl+L to display the lower pane, press Ctrl+D to have DLLs in the lower pane, and then click Ctrl+A to save the contents of the window to a text file. Then post the contents of that file (or attach it to your post).

This should give us a complete list of modules (DLLs) loaded into ashDisp.exe address space.

Thanks
Vlk

[rreinhardklein]

The worm contained in "Postcard.exe" is again sent around just now by a false Hallmark- Email offering an e-card.
The offer is written in bad english and refers to a german web-domain offering a download of Postcard.exe
I assume it is a worm- have not dared to actually download and execute it to test my avast.
anyone who wants it for test purposes pls send me a msg- I will send the downloadlink. and eml file