outgoing email question/problem?

I searched for this issue, couldn’t find anything, so hopefully this is not a duplication.

I have Avast free version; it does not seem to be checking the outgoing mail. I mention this because I am recently getting a lot of “undeliverable” notices from my ISP. I don’t know if I am sending spam, or if this is one of the latest spam methods. I ran a virus scan, completely clean. So… how can I get Avast to check outgoing smtp mail? It clearly checks all incoming, for example if I send myself an email, I see the incoming as being checked, but I never see the outgoing. My OS is XP service pack 3, all latest upgrades, my smtp is not secure. I changed my password on the affected account, made no difference.

Thanks in advance for any suggestions!!

Phil

What email client are you using?

Hi Craig, I’m using Thunderbird. But my concern is that Avast is not seeing not only my Thunderbird smtp, but it probably also won’t see any smtp from a spam program.

Have you also set the outgoing security to none in thundrbird ?, needs to be set to none for outgoing and incoming.

You dont mention who your email provider is ?

Yup, outgoing security is set to none on all accounts. I’m using Bluehost as my ISP.

just a question…does the mail go out…they recive it at the other end?

Yes, the mail goes out fine on all of my various accounts. At this point I am really just looking for a way to determine if my PC is actually sending spam, or if this is just mail made to look like returned mail so I’ll click on a link. the messages look real though, and a few of them do have my IP address in them. Why Avast is not detecting outgoing mail I don’t know… but perhaps that is the virus preventing it from being seen. I think I’ll run a boot scan to see if that finds anything.

if you want a check inside…Essexboy is the man

attach the logs from Malwarebytes / OTL / aswMBR
http://forum.avast.com/index.php?topic=53253.0

Good suggestion to run Malwarebytes… thanks… result negative!

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.09.11

Windows XP Service Pack 3 x86 FAT32
Internet Explorer 8.0.6001.18702
pb :: USER04 [administrator]

8/9/2012 2:36:31 PM
mbam-log-2012-08-09 (14-36-31).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 207493
Time elapsed: 3 minute(s), 57 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

also OTL and aswMBR

Here we go

And aswmbr.txt (couldn’t figure out how to attach both in same post)

Essexboy is notified… and i guess in bed now or watching olympics :wink: so check back tomorrow

thank you kind sir!! Be back tomorrow!!

Are the mails appearing in your outbox ?

Hello Essexboy! No, the “undeliverable” emails that my ISP is telling me about are not in my sent folder. None of the recipient names of these emails are anyone I know, nor are they in my contact list. If I have a virus that is sending spam, wouldn’t it be it use it’s own email client/program, so as not to be detected?

I’m still wondering why Avast is not showing that it’s checking my outgoing… isn’t that a strong indicator that I have some infection?

Thanks…

The Avast out and in stamps have been discontinued as they could lead to a false sense of security … Easily faked by spammers/phishers when they send the mail out

As they are not in your sent box then you have not been sending them… Someone has Hijacked your e-mail address

Hi, thanks for the quick response! I think you are probably correct that my account was hijacked. I did change the password on the account and the returned emails seem to have stopped.

Just a note however about emails appearing in my outbox or sent folder, my understanding is they would only do that if someone was actually using my specific email client (Thunderbird) to do the sending on my machine. For example, I’ve used “telnet” from the command prompt to send and receive emails from a simple program I wrote years ago in Basic. There is no trace on the PC of any email activity when doing that. I just checked and XP SP3 still supports that command line program.

Most likely someone was using one of the many sendmail programs out there on another PC somewhere.

But thanks to everyone… the response on this forum was fantastic and amazingly fast! There is a lot of talent and knowledge here!

I think you are probably correct that my account was hijacked. I did change the password on the account and the returned emails seem to have stopped.
Take a look at the following video (with Audio), that will explain the proper [url=http://portal.sliderocket.com/BSIUN/Recovering-from-an-Email-Hijack-_Hack_]Recovery from an Email Hijack (Hack)[/url] I've produced this from a portion of [url=http://forum.avast.com/index.php?topic=78426.0]my presentation which is available for computer club and other groups of computer users[/url].