Mail-Scanner scanning thousands of outbound mails...can i just block all?

system · 2007-08-11T19:21:23.000Z

Hello dear Forum!

On a rather old laptop (Dell Inspiron 4100, Windows XP) I have had quite a few virus attacks. Thankfully, avast managed to get rid of most the threats. Unfortunately, something strange is still happening.

From the second I plug in my network cable the avast! Mail On-Access Scanner starts working like mad, scanning around 5 emails every second. The resident protection’s log reads things as:

Last Scanned: Outgoing email “Best Quotes” OR “Cheap Deals” From: cheeseman@greentek.biz To: somerandomnamehere@hotmail.com or @wanadoo.fr

The sender is always @greentek.biz- a “parked” domain - and the subject is typical spam advert matter. I suspect that a trojan is using my computer to send mass spam emails.

Personally, whenever I use emails I log into googlemail on my browser, without any problems there… I have no need for Outlook or Thunderbird. Since avast doesn’t find any virus or worms, I was thinking: Would it be possible to just shut down the port for “outgoing emails” (I believe that has to do with the SMTP protocol but I don’t know much about it) to just block every single email that is being sent from my computer? My performance suffers dearly from these thousands of outgoing emails.

Kind thanks in advance

DavidR · 2007-08-11T19:29:11.000Z

Well it looks like you have an undetected trojan spambot (which has its own small SMTP program) at work.

What is your firewall ?

The spambot may well be hidden by a rootkit, try there anti-rootkit tools:

BlackLight - It can detect rootkits like Rootkit Revealer but can also remove them. http://www.f-secure.com/blacklight/
Panda Rootkit Cleaner - http://research.pandasoftware.com/blogs/images/AntiRootkit.zip also see http://research.pandasoftware.com/blogs/research/archive/2007/04/02/Panda-AntiRootkit-Released.aspx or http://www.pandasoftware.com/.
AVG ANTI-ROOTKIT - AVG Anti-Rootkit http://free.grisoft.com/doc/avg-anti-rootkit-free/lng/us/tpl/v5.

Also see, anti-rootkit, detection, removal & protection http://www.antirootkit.com/software/index.htm.

If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode after using one or moe of the anti-rootkit tools.
AVG anti-spyware (formerly Ewido). Or SUPERantispyware Or Spyware Terminator.

Announcements