Can't receive any email

Discussion in 'Malware Help (A Specialist Will Reply)' started by Opik, Mar 15, 2006.

  1. Opik

    Opik Private E-2

    I can send messages, but I can't receive any. I am using Outlook Express. When I click on send/receive the message box comes up saying it is receiving 1 of 10 mesages then that quickly goes away and the follow error message comes up:

    Your server has unexpectedly terminated the connection. Possible causes for this include server problems, network problems, or a long period of inactivity. Account: 'dickdee@attglobal.net', Server: 'popa.attglobal.net', Protocol: POP3, Server Response: '+OK', Port: 110, Secure(SSL): No, Error Number: 0x800CCC0F

    I have tried dissabling my antivirus and my firewall and I still receive the same error message.
    The weird part is I tried booting into safe mode with networking. Then I opened outlook express and I was able to receive all my email. Then I rebooted into normal mode and opened outlook express. I didn't receive any error messages. But then I sent myself an email using another computer and I got the same error message. So, I am convinced that there is some kind of malware blocking the email.

    The computers specs are: Windows xp, home edition with service pack 2.
    504 MB RAM, pentium m 1.10GHz, 32 GB hard drive.

    I have read and followed the instructions on the read me file.
    After running Bitdefender I manually removed the messages in outlook express that it complained about.
    After running Panda ActiveScan in safe mode with networking I lost my network connection, so I couldn't save the report (it wouldn't show me the report without a network connection. So, I rebooted and ran it in normal mode so I could save the report.

    Thanks in advance for the help
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Majorgeeks!

    I'm not sure that your problem with email is malware related. I have seen things like this where antivirus or antispam software keeps changing the pop3 incoming mail server. Check to see if it is correct. It may change after each reboot too.

    However you do have some malware to be very concerned about. A process named links.exe is loading.
    You are strongly advised to do the following immediately:

    1. Disconnect infected computer from the internet and from any networked computers until the computer can be cleaned.

    2. Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.

    3. From a clean computer, change *all* your online passwords -- for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.

    Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passords and transaction information.

    Also note your Sun Java version is way out of date and must be updated.

    You need to manually cleanup the infect email messages in your inbox. See the BitDefender log for what it found.

    Is the below Bytemobile file really missing (look in C:\WINDOWS\system32 for it)? Is the application working okay.
    O10 - Broken Internet access because of LSP provider 'bmnet.dll' missing

    Make sure viewing of hidden files is enabled (per the tutorial).
    Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Look for the below process(es) and if found, End them:

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    F3 - REG:win.ini: run=,
    O4 - HKLM\..\Run: [links] links.exe

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    C:\WINDOWS\system32\links.exe

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

    Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
    Now run Ccleaner (installed while running the READ ME FIRST).

    Now we need to Reset Web Settings:
    1. If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
    2. Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
    3. If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.
    Now reboot in normal mode and post a new HJT log.

    Make sure you tell me how things are working now.

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
  3. Opik

    Opik Private E-2

    Thanks for your reply, Chaslang.

    I fixed the email problem, I had to turn "internet e-mail auto protect" off in symantec.

    The file is there. I don't know how to fix this message.

    I removed the 3 entries in HJT.
    However, c:\\windows\system32\links.exe was not there.

    Attached is the new HJT log.
    Everything seems to be working now.

    Thanks for the help
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Don't worry about it. As long as the application and your internet connection are working okay, just ignore the message.

    Your log is clean. If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

    After that, you should work thru the below link:

    How to Protect yourself from malware!
     
  5. Opik

    Opik Private E-2

    Thank you for your help, Chaslang.
    You are my hero!
     
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds