Outlook- Trojan?

[Billyboy294]

When i tried to open Outlook (Hotmail on IE8 i got this message. It asked me to fill in details of my card and as I don't have a 'card' for Outlook , naturally i did not proceed.

 

Suspicious activity is detected. Your account is locked

Your account was sending spam, and for this reason it is temporarily blocked. To unlock your account, you must confirm that you are a real person and not a robot, and to prove you are the owner of the account. To do this, go through a simple verification procedure and fill out the form and submit it below. Immediately after that, your account will be unlocked. Please note that the data required for verification is not stored on live servers and used only once to unlock your account.Thank you for your understanding.

Please do not forget to change your password after you unlock your account

Country Country(AF) Afghanistan(AL) Albania(DZ) Algeria(AS) American Samoa(AD) Andorra(AO) Angola(AI) Anguilla(AQ) Antarctica(AG) Antigua and Barbuda(AR) Argentina(AM) Armenia(AW) Aruba(AU) Australia(AT) Austria(AZ) Azerbaijan(BS) Bahamas(BH) Bahrain(BD) Bangladesh(BB) Barbados(BY) Belarus(BE) Belgium(BZ) Belize(BJ) Benin(BM) Bermuda(BT) Bhutan(BO) Bolivia(BA) Bosnia and Herzegovina(BW) Botswana(BV) Bouvet Island(BR) Brazil(BQ) British Antarctic Territory(IO) British Indian Ocean Territory(VG) British Virgin Islands(BN) Brunei(BG) Bulgaria(BF) Burkina Faso(BI) Burundi(KH) Cambodia(CM) Cameroon(CA) Canada(CT) Canton and Enderbury Islands(CV) Cape Verde(KY) Cayman Islands(CF) Central African Republic(TD) Chad(CL) Chile(CN) China(CX) Christmas Island(CC) Cocos Islands(CO) Colombia(KM) Comoros(CG) Congo - Brazzaville(CD) Congo - Kinshasa(CK) Cook Islands(CR) Costa Rica(HR) Croatia(CU) Cuba(CY) Cyprus(CZ) Czech Republic(CI) Cote d'Ivoire(DK) Denmark(DJ) Djibouti(DM) Dominica(DO) Dominican Republic(NQ) Dronning Maud Land(EC) Ecuador(EG) Egypt(SV) El Salvador(GQ) Equatorial Guinea(ER) Eritrea(EE) Estonia(ET) Ethiopia(FK) Falkland Islands(FO) Faroe Islands(FJ) Fiji(FI) Finland(FR) France(GF) French Guiana(PF) French Polynesia(TF) French Southern Territories(FQ) French Southern and Antarctic Territories(GA) Gabon(GM) Gambia(GE) Georgia(DE) Germany(GH) Ghana(GI) Gibraltar(GR) Greece(GL) Greenland(GD) Grenada(GP) Guadeloupe(GU) Guam(GT) Guatemala(GG) Guernsey(GN) Guinea(GW) Guinea-Bissau(GY) Guyana(HT) Haiti(HM) Heard Island and McDonald Islands(HN) Honduras(HK) Hong Kong SAR China(HU) Hungary(IS) Iceland(IN) India(ID) Indonesia(IR) Iran(IQ) Iraq(IE) Ireland(IM) Isle of Man(IL) Israel(IT) Italy(JM) Jamaica(JP) Japan(JE) Jersey(JT) Johnston Island(JO) Jordan(KZ) Kazakhstan(KE) Kenya(KI) Kiribati(KW) Kuwait(KG) Kyrgyzstan(LA) Laos(LV) Latvia(LB) Lebanon(LS) Lesotho(LR) Liberia(LY) Libya(LI) Liechtenstein(LT) Lithuania(LU) Luxembourg(MO) Macau SAR China(MK) Macedonia(MG) Madagascar(MW) Malawi(MY) Malaysia(MV) Maldives(ML) Mali(MT) Malta(MH) Marshall Islands(MQ) Martinique(MR) Mauritania(MU) Mauritius(YT) Mayotte(FX) Metropolitan France(MX) Mexico(FM) Micronesia(MI) Midway Islands(MD) Moldova(MC) Monaco(MN) Mongolia(ME) Montenegro(MS) Montserrat(MA) Morocco(MZ) Mozambique(MM) Myanmar(NA) Namibia(NR) Nauru(NP) Nepal(NL) Netherlands(AN) Netherlands Antilles(NT) Neutral Zone(NC) New Caledonia(NZ) New Zealand(NI) Nicaragua(NE) Niger(NG) Nigeria(NU) Niue(NF) Norfolk Island(KP) North Korea(VD) North Vietnam(MP) Northern Mariana Islands(NO) Norway(OM) Oman(PC) Pacific Islands Trust Territory(PK) Pakistan(PW) Palau(PS) Palestinian Territories(PA) Panama(PZ) Panama Canal Zone(PG) Papua New Guinea(PY) Paraguay(YD) People's Democratic Republic of Yemen(PE) Peru(PH) Philippines(PN) Pitcairn Islands(PL) Poland(PT) Portugal(PR) Puerto Rico(QA) Qatar(RO) Romania(RU) Russia(RW) Rwanda(RE) Reunion(BL) Saint Barthelemy(SH) Saint Helena(KN) Saint Kitts and Nevis(LC) Saint Lucia(MF) Saint Martin(PM) Saint Pierre

 

But when I went to Malawarebytes to do a check, and after with my Avira Anti- virus, neither would open and i got same  message saying "prevented by a software restriction policy". Seems to me there is a connection and i am being blocked from removing this Trojan/Virus.

 

Anyone had this problem.

[Billyboy294]

I have tried 5 times to delete the list of countries which i never copied/pasted and each time Firefox crashes. I did have the box with the 'Country' drop-down menu.

 

Will try again.

 

Everything was OK this morning. I did a System Restore to 3rd Mar. but no better. My Avira Antivirus is off and it wont let me put it on again.

 

I get this message, same for Avira.

 

[Sexy Baldman]

sounds like a fishing scam to get your c.card details...why not go to an internet cafe and see if you can log into your email account there?

[Billyboy294]

Every time I try to open Outlook. i get the Pfishing message but when i close it and open Outlook again it opens and works normally.

 

The problem is trying to  get rid of the Trojan/virus as it blocks all my attempts.

 

Not sure whether to uninstall Avira and try reinstall or perhaps even another one such as Avast.

 

I also got a Message from Advanced System Care which implied it had a problem but when I opened it I did a SCAN and it completed and said my system was 'healthy'.

 

I have an expert coming tomorrow afternoon.

[butler]

go to your control panel and restore computer to a earlier date before problems started .

[Billyboy294]

I have tried 5 times to delete the list of countries which i never copied/pasted and each time Firefox crashes. I did have the box with the 'Country' drop-down menu.

 

Will try again.

 

Everything was OK this morning. I did a System Restore to 3rd Mar. but no better. My Avira Antivirus is off and it wont let me put it on again.

 

I get this message, same for Avira.

 

AVs blocked..jpg

 

 

go to your control panel and restore computer to a earlier date before problems started .

[CyberPro]

I'd suggest attempting malware removal by starting using bootable media that has rescue software. In your case (Avira), the links below have directions. Obviously don't create the rescue media using the infected computer.

 

A friend was trying to update a Norton security product. The update wasn't going well. He then got a phone call at his HOME from a woman with (as I recall), an East Indian accent offering to clean his computer for a fee. Completely freaked out my friend and he went out and bought a replacement for his aging PC. ;)

 

I've read that system restores don't get rid of malware.

 

Thanks for the pictures you post.

 

http://forum.avira.com/wbb/index.php?page=Thread&threadID=82163

 

https://www.google.com/search?q=Avira+Antivirus&oq=Avira+Antivirus&aqs=chrome..69i57.836j0j7&sourceid=chrome&espv=210&es_sm=93&ie=UTF-8#q=Avira%20Antivirus%20rescue%20cd

[Billyboy294]

A friend suggested Hitmanpro and i downloaded it OK and  clicked 'scan one time only' thinking  that was a free trial and it did find 24 bad items and other minor ones but then found they would not remove /quaranteen them until i put in serial number.

 

On Google they show a few links with crack or Keygen but when i opened them i could not see anything helpful.

 

Anyone know a free one or one with a Keygen .

[zenzen11]

Are you in Pattaya ?

I can fix your computer for you..

... To start ..

... Try a program called "hijack this" ...

 

Pm me if you are in pattaya .. I will come fix your computer and reach you how to fix it yourself ..

..

Also .. You can find cracked anti virus programs on torrent sites ..

Worst has scenario .. Reload Windows over the old windows ..and all your current files will be stored in a folder called " old windows" after you boot into the new install

[Billyboy294]

Yes i am in Pattaya. Many thanks for your offer but i have a computer friend coming tomorrow so i will see what he can do.

 

I downloaded hijackthis and it did a Scan producing a list of well over a hundred items in less than 2 seconds Should it scan that fast? Sometimes Avira takes 20 minutes. I have XP.

 

My problem is how to recognise a bad guy to remove it. I did see one i had a problem with some months ago called 'snap.do' so i checked this and  removed it.

 

When I try to open Outlook,  at the bottom left,  the website address keeps 'flashing' when trying to open but sometimes i also see very briefly two addresses which look as if they might be 'bad guys'.

 

namely: gravatar.com and grab.information.com but did not see them on the scanned list.

[zenzen11]

Cool .. Good luck ..

If you guys can't get it ..

I am sure I can ... :-)

[Daddee]

I would love to meet the assholes that create this shit, and crush both their hands into pulp...

[zenzen11]

Well ... You clicked on something that brought this to your computer .. :-) ...

... My mother had the same type of thing ..

... Need "hijack this" to list all registry entries that are currently running and that start when you boot windows ..

... Manually remove these items .. Then start in SAFE MODE .. Run anti virus ..

Restart PC again

... "Hijack this" again ... Check that registry items have not been readded ..

...

If you were able to even run SYSTEM RESTORE .. Then its not too bad .. Most good virus/ Trojans won't let you do this ..

Or download new anti virus programs from the web

... ..

.. Can you reset your FOLDER View to show "hidden files and folders"?.. If you can .. Its not that bad ..

If you can't than its a good virus/Trojan ( good in that it was designed well ... Not good for you) ..

[Billyboy294]

I'd suggest attempting malware removal by starting using bootable media that has rescue software. In your case (Avira), the links below have directions. Obviously don't create the rescue media using the infected computer.

 

A friend was trying to update a Norton security product. The update wasn't going well. He then got a phone call at his HOME from a woman with (as I recall), an East Indian accent offering to clean his computer for a fee. Completely freaked out my friend and he went out and bought a replacement for his aging PC. ;)

 

I've read that system restores don't get rid of malware.

 

Thanks for the pictures you post.

 

http://forum.avira.com/wbb/index.php?page=Thread&threadID=82163

 

https://www.google.com/search?q=Avira+Antivirus&oq=Avira+Antivirus&aqs=chrome..69i57.836j0j7&sourceid=chrome&espv=210&es_sm=93&ie=UTF-8#q=Avira%20Antivirus%20rescue%20cd

 

I was mistaken about System Restore. After using it twice when 'finished it went back to  desktop and on a 3rd occasion to 27 Feb it said 'could not complete the restoration'  so my system was never restored.

 

The annoying thing is I dont even know what i could have done to get this infection which is unlikely to get any one to give details of their Credit Card but yet it seems able to block antivirus'/malaware programs.

[zenzen11]

Yes i am in Pattaya. Many thanks for your offer but i have a computer friend coming tomorrow so i will see what he can do.

 

I downloaded hijackthis and it did a Scan producing a list of well over a hundred items in less than 2 seconds Should it scan that fast? Sometimes Avira takes 20 minutes. I have XP.

 

My problem is how to recognise a bad guy to remove it. I did see one i had a problem with some months ago called 'snap.do' so i checked this and  removed it.

 

When I try to open Outlook,  at the bottom left,  the website address keeps 'flashing' when trying to open but sometimes i also see very briefly two addresses which look as if they might be 'bad guys'.

 

namely: gravatar.com and grab.information.com but did not see them on the scanned list.

 

Yes .. Hijack this is very quick ..

it just lists what is running (and what will run when system starts)

 

it will not do anything unless you tell it too .. 

 

 .. it is a little difficult to understand .. and you need to read the "info" button bottom right to understand what is what .. 

 

if you run a "scan and save log file" .. it will output a txt file .. 

send it too me via PM and I can help you figure it out .. 

 .. BASICALLY .. you look for items with any names you do not recognize .. 

 .. so things that ARE NOT "windows/google/firefox/adobe" ... etc .. or programs you use like .. photoshop or whatever ..

 .. 

also .. even if you remove those things you do not recognize .. 

the Trojan will probably just put them back in the next time you boot your computer .. 

often in a different place than the first time :-) 

 .. 

 .. do you know how to use Torrent files? .. you can get full versions of anti virus free .. 

most anti virus programs have full versions for free anyway (with a time limit) .. 

so you can download them from www.download.com  .. and use them once or twice . 

 .. but, like you said  .. the trojan will block these downloads (and possibly the install) .. 

so you need another computer to do the download .. and then install under SAFE MODE .. (after an install cleaning with HiJack this)

then rerun both HiJack This and antivirus/anti-malware again .. 

 

 I hope you and your buddy get this worked out .. 

if not .. 

I can help you .. and show you the steps to go through in case this happens again .. 

 

 ... I am one of the few(?) people that NEVER use anti virus programs .. 

I mean, I do not have one running in the background all the time (they tend to interfere with some of the other things I want to do with my computer)

 .. so .. about once every 3 years(?) I will get a virus (and this is always after I am playing around on parts of the web that are not so safe .. and/or downloading things that I suspect may be infected) ... 

 ... I am have never gotten a virus/trojan that I could not get rid of .. 

just takes time .. 

 

 .. also .. like I said earlier  .. 

if you have a Windows Install disk (or the image from a Torrent)

you can just re install a new Windows over the old one  .. 

this will rewrite the whole registry ... and start your PC from scratch .. 

all while saving the old files in a folder called "old windows" .. 

 

good luck .. HAVE FUN :-) 

[Billyboy294]

Thanks again for your reply.

 

I went to Hijackthis again to send you what it finds but it is now blocked. "prevented by a software restriction policy" I tried 5 times and no luck.

[zenzen11]

Thanks again for your reply.

 

I went to Hijackthis again to send you what it finds but it is now blocked. "prevented by a software restriction policy" I tried 5 times and no luck.

 

Wow ... You got a nice one ..

 

... Did you and your friend get it straighted out? ...

 

.. Pm me if you would like my help ..

 

Might take a couple hours .. But I am sure we can get rid of this thing ..

[zenzen11]

Try running hijack this in SAFE MODE ...

[Billyboy294]

Thanks again for your suggestions and offer of help.

 

My friend formatted the hardrive and we have got XP back on and also all my drivers software and other stuff like Pictures back on.

 

I had  backed up all my stuff on USBs yesterday;  well i always do this but made sure it was updated.

 

Every thing seems to be working fine.

[zenzen11]

Good to hear ...

... A nice fresh computer ...

 

Good job ...

[Billyboy294]

Since i came back on to Addicts , I keep getting this message. I never had it before.

 

........like to install plugin needed to display media.

Install Flash.

 

Should i install this?

 

Under Windows /Tasks i already have Adobe Flash Player Updater

[zenzen11]

Go to the official Adobe site .. Adobe.com or whatever it is ..

And update your Adobe from there ...

... Always do this for any "update" messages ... Go to the program website ..

 

.. Also be very aware of any pop up that looks like an "official Windows" message that pops up when on the internet... Windows will just automatically update these things itself ...

.. They do NOT ask you to click on things in browser pop ups .. ..

[Billyboy294]

OK, thanks. I was a bit suspicious  so never 'installed' it.

[Billyboy294]

After  my hardrive was formatted and XP reinstalled everything seemed to be working fine. However i quite often see on Addicts posts a message About Adobe Flash.  Also saw it in the Daily Mail.

 

See enclosed. On one post it apeared twice, before and after a photo. It doesnt appear on any of the posts on this topic.

 

Do others see this or is it only me. I have done a few AV checks but it is still there. I just ignore it and move on.

 

[CyberPro]

After  my hardrive was formatted and XP reinstalled everything seemed to be working fine. However i quite often see on Addicts posts a message About Adobe Flash.  Also saw it in the Daily Mail.

 

See enclosed. On one post it apeared twice, before and after a photo. It doesnt appear on any of the posts on this topic.

 

Do others see this or is it only me. I have done a few AV checks but it is still there. I just ignore it and move on.

 

Popup.jpg

I don't ever see that, nor would I click on it if I did.

 

So you've reformatted your hard drive, done a fresh operating system install and still see things like that?

 

One might wonder what sites you are visiting, what browser you are using (Google Chrome can block suspicious sites), if you have antivirus, anti malware (https://www.malwarebytes.org/ is good, and free, the paid version does real time protection), upgrade your OS for security patches (I read that Windows XP won't get these from Microsoft after April 15...pity), etc.

 

Doing a disk reformat and OS install isn't a lasting fix if one continues the practices that caused the previous (and apparently current) issues.

 

In the opinion of some, post XP windows is $(@)!, but what can one do? I know, switch to Linux or MAC OS. ;)

 

Good luck and again thanks for the pics.

 

http://www.mercurynews.com/business/ci_25392568/facing-windows-xp-apocalypse-here-are-some-options