Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

automatically sending emails

Status
Not open for further replies.
cantwin4losing

cantwin4losing

Technical User
Sep 11, 2006
4
US
There is something on my computer that is sending emails out automatically. Like 10 or 15 at a time. The only way I caught it was because my virusware scans the emails before they go out. Nothing is being picked by Norton Anti-virus or by Ad-aware. There are alot of processes running when this occurs and it will not let me end those processes. It tells me access denied. Alot of the processes are named LuCallbackProxy.exe Can someone help?
 
Sort by date Sort by votes
Start with the FAQ for this forum. Look carefully for the ones that talk about free virus scanners, HiJackThis, and removing Ad/Spyware. See how far you can get then let us know.


James P. Cottingham
-----------------------------------------
[sup]I'm number 1,229!
I'm number 1,229![/sup]
 
Upvote 0 Downvote
Thanks, I will start with that and see where I can get. If I need more help, I will let you know.
 
Upvote 0 Downvote
I don't want to sound dumb, but I really want to get my computer fixed. I have downloaded HijackThis and ran it. Saved the log. How do I post it on here for someone to look at? I also ran StartupList and saved that log. PLEASE HELP!!
 
Upvote 0 Downvote
Ok, keep calm - just post the contents of the files in your next post, we'll get some diagnostics done and advise you how to proceed.

One step at a time, ok?
 
Upvote 0 Downvote
You can also go to hijackthis.de and browse to where you saved the log and run a check there, too.


James P. Cottingham
-----------------------------------------
[sup]I'm number 1,229!
I'm number 1,229![/sup]
 
Upvote 0 Downvote
Thank you guys so much for your offer to help. Here is the log from HijackThis. Could someone please take a look? I would appreciate any feedback. Thanks!


Logfile of HijackThis v1.99.1
Scan saved at 10:04:30 AM, on 9/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - O16 - DPF: {20048BB3-DB68-11CF-9CAF-00AA006CB425} - O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - O16 - DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} - O17 - HKLM\System\CCS\Services\Tcpip\..\{201DF45D-DA01-4F82-BCEA-91E98344AEEE}: NameServer = 208.196.77.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{201DF45D-DA01-4F82-BCEA-91E98344AEEE}: NameServer = 208.196.77.1
O20 - Winlogon Notify: jljhmrsu - C:\WINDOWS\SYSTEM32\jljhmrsu.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
 
Upvote 0 Downvote
This entry is possibly nasty. Should be fixed.

O16 - DPF: {20048BB3-DB68-11CF-9CAF-00AA006CB425} -

Check if you know this site and fix it if you do not.

O16 - DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} -

If this Domain does not belong to your ISP, or your firms network, these entries should be fixed.

O17 - HKLM\System\CCS\Services\Tcpip\..\{201DF45D-DA01-4F82-BCEA-91E98344AEEE}: NameServer = 208.196.77.1

AND

O17 - HKLM\System\CS1\Services\Tcpip\..\{201DF45D-DA01-4F82-BCEA-91E98344AEEE}: NameServer = 208.196.77.1


Unknown

O20 - Winlogon Notify: jljhmrsu - C:\WINDOWS\SYSTEM32\jljhmrsu.dll

CharlesCook.com
ADP - PeopleSoft - SAP
ReportSmith - Crystal Reports - SQR - Query - Access
Reporting - Interfaces - Data Mining
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

spizotfl
  • Locked
  • Question
Reporting Phishing emails
Replies
2
Views
78
goombawaho
goombawaho
KornFuse
  • Locked
  • Question
IE browser opening automatically. Registry infected with Trojan; recre 1
2
Replies
22
Views
250
kjv1611
kjv1611
jwaffe
  • Locked
  • Question
Automatically deleting .exe s on a system running NIS 2010
Replies
0
Views
65
jwaffe
jwaffe
bkirkpatrick
  • Locked
  • Question
No Virus found but AVAST shows spam emails being sent!
Replies
2
Views
71
electronicsfreak
electronicsfreak
fh786
  • Locked
  • Question
Symantec Corporate Antivirus not updating automatically
Replies
1
Views
44
cricket
cricket

Part and Inventory Search

Sponsor

Back
Top