Hello,
Apparently the infection “JS:Downloader-DAM (Trj)” of an email has been blocked some days/weeks ago. I deleted the email and also cleaned the “virus container” so that I do not find the respective email and it seems to be completely deleted. However I still get the notification about the blocking every time I check my emails via Outlook. (By the way also the button “report as false alarm” does not work.) What can I do that this notification concerning this case does not appear again and again. Thank you very much for helping me with this issue.
is the mail still located at “webmail”
access your mail account from web browser and check / delete
empty webmail trash folder, reboot and try mail client again
any change?
Hello,
Thanks a lot for your message.
Unfortunately the warning is still coming. (As additional information: I first deleted the message with my Smartphone Webmail access but now the infected mail is completely deleted in the mail system - as far as I can see. However I still get the warning every time I check my mails with my Outlook and the IMAP.)
The first warning I got in this matter was: “Threat was blocked and moved to the chest on device: …local.… This is a Warning severity notification.”
Thanks in advance for giving me further possible solutions.
You need to delete the detected mail from the server.
With IMAP mails are kept on the server and Outlook is trying to get that mail each time you open Outlook.
did you also empty the trash folder in webmail and mail client
Thanks for your answers, but I deleted the mail from the server and also checked all folders and do not find it anymore
I think that the file is still somewhere on my computer. (No other computer in our network gets the notifications.)
The exact wording of the notification is as follows (I meanwhile changed the language from German to English):
Threat blocked
Object
Incoming email „…“ from: „…“
Infection
JS:Downloader-DAM [Trj]
Process
C:\Program Files\Microsoft Office 15\root\office15\outlook.exe
The threat was detected and blocked while sending or receiving an email.
Report the file as false positive
Details
follow instructions here https://forum.avast.com/index.php?topic=53253.0
we need Malwarebytes and Farbar Recovery Scan Tool logs, attach the logs, 3 logs total
see below the box you write in … Attachments and other options
When done a expert will check logs and assist you … he will be online after 15:00 european time
Thanks for your advice.
Please find the requested attachements below. (Unfortunately Farbar has been installed automatically in German but I hope you are able to analyze it anyway.)
Thank you very much in advance.
What is the full location given by Avast ?
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint: Task: {79D3B68C-201B-4E5F-A587-18E473F3B80D} - \WPD\SqmUpload_S-1-5-21-3033235070-39548027-820294786-500 -> Keine Datei <==== ACHTUNG Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
Run FRST and press Fix
On completion a log will be generated please post that
THEN
Please download AdwCleaner by Xplode onto your Desktop.
[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool
[*]Click the Scan button and wait for the process to complete.
[*]Click the logfile button and the log will open in Notepad
[*]Click on the Clean button follow the prompts.
[]A log file will automatically open after the scan has finished and the PC has rebooted
[]Please post the content of that log file with your next answer.
[*]The report will be saved in the C:\AdwCleaner folder.
Hello,
Thanks a lot.
In the meantime I followed all your steps. Please find the requested files attached.
I’m waiting for your further information.
Regards
Did you empty the deleted e-mail folder ?
Yes, as far as I can see in the various folders the email is not there any more.
(If you have a different information maybe you can tell me the exact name of the folder or of the respective file.)
Thanks
Have the alerts now ceased ?
Unfortunately they are still there…
Could you attach a screenshot of the avast alert please
Please find the screenshot in the attachement
Hmm office can be a total pain to clean up, Avast will not remove it as it will break your inbox.
OK first go online to your e-mail and using the web portal delete it there first and foremost
Then clean all folders withing Outlook as described here https://www.howto-outlook.com/howto/cleanmailbox.htm
Thanks for your effort.
By now I did not clean all the folders because I think I already deleted the critical email in all available folders (in the web portal and in Outlook) and I think that the blocked threat (email) must be somewhere else in the system…
Please find attached the weekly report and hope this is helpful somehow.
Just had another look at the alert and it states incoming, this would suggest that it was not deleted from the online web host