I am getting desperate - Advice needed from techy members re spam sending email trojan | Warrior Forum - The #1 Digital Marketing Forum & Marketplace

9 years ago

What do you mean your ISP has been blacklisted? Are all their customers affected the same way?

Or did you mean your IP is blacklisted? An IP and ISP are not the same thing.

What is CBL?

What is the name of the Trojan?

Has it been detected and identified by anti-virus software?

What do you mean Fri-Mon everything ran clear? Do you mean your anti-virus detected no infection? But then on Monday your anti-virus did detect an infection? That seems weird.

Best thing to do would be run antivirus and antitrojan software to detect and remove it.

[ 1 ] Thanks
1 reply

{{ DiscussionBoard.errors[9744358].message }}

SandyDuPlessis

9 years ago

Sorry, I meant IP not ISP.

CBL - Composite Blocking List - The CBL

From time to time the name of the trojan changes according to the CBL report at the moment it is showing as the cutwail virus.

My anti virus does not detect it. (I have tried several)

When I said that Mon to Friday everything ran clear, I meant that CBL could not detect anything and then on Monday late afternoon CBL reported that it had started up agan.

I have run all sorts of software that I know of to detect and remove it but no luck so far.

Thanks
1 reply

Signature

WSO - You Need To Add Or Improve On This One Element Of Your Business
And Your Income Will Explode! - Video Is Your Secret Weapon

{{ DiscussionBoard.errors[9744387].message }}

Joe Mobley

9 years ago

It appears the cutwail is a rootkit virus on Windows systems.

My Mac IP address is blacklisted on zen.spamhaus, I2.apews.org, and pbl.spamhaus. The Blacklist message says that my IP address is listed in the CBL because it is infected with, or NATing for a machine infected with, Pushdo - usually associated with the Cutwail Span Trojan as a part of a Zeus or Spyeye Botnet detected by DDOS traffic to a web server.

https://forum.avast.com/index.php?topic=133009.0

Originally Posted by SandyDuPlessis

From time to time the name of the trojan changes according to the CBL report at the moment it is showing as the cutwail virus.

Joe Mobley

Thanks
1 reply

Signature

.

Follow Me on Twitter: @daVinciJoe

{{ DiscussionBoard.errors[9745000].message }}

SandyDuPlessis

9 years ago

Originally Posted by Joe Mobley

It appears the cutwail is a rootkit virus on Windows systems.

https://forum.avast.com/index.php?topic=133009.0

Joe Mobley

That is part of what has got me so confused. I followed the instructions to clean the PC manually because I thought that was where the problem lay, but there is nothing there. It is clean.

I have now spent the last couple of hours investigating "spoofing" and it is beginning to look like that is where my problem might lie.

These are 3 of the (rather numerous) sites that I have been looking at:

How Spammers Spoof Your Email Address (and How to Protect Yourself)

Email spoofing - Wikipedia, the free encyclopedia

DMARC - Frequently Asked Questions

Thanks
1 reply

Signature

WSO - You Need To Add Or Improve On This One Element Of Your Business
And Your Income Will Explode! - Video Is Your Secret Weapon

{{ DiscussionBoard.errors[9745109].message }}

Joe Mobley

9 years ago

There's something going on that we don't know about yet.

Are there other Windows PC's that use your network?

This is your home network, correct?

Do you have WiFi setup?

You have enabled Network Encryption?
This may help.
How to Secure your Wi-Fi Network (or Wireless Internet Connection)

When the CBL reports trojan or virus activity, is the Windows PC on the network? Other PC's?

I'll have more to ask later.

Joe Mobley

Originally Posted by SandyDuPlessis

That is part of what has got me so confused. I followed the instructions to clean the PC manually because I thought that was where the problem lay, but there is nothing there. It is clean.

I have now spent the last couple of hours investigating "spoofing" and it is beginning to look like that is where my problem might lie.

These are 3 of the (rather numerous) sites that I have been looking at:

How Spammers Spoof Your Email Address (and How to Protect Yourself)

Email spoofing - Wikipedia, the free encyclopedia

DMARC - Frequently Asked Questions

Thanks

Signature

.

Follow Me on Twitter: @daVinciJoe

{{ DiscussionBoard.errors[9745159].message }}

eac113

9 years ago

I would hire a pro to get under the hood and run some diagnostics, there can be stuff hiding in there that your anti-virus will not detect. You need some-one with skills in this area to do a deep clean.

[ 1 ] Thanks

{{ DiscussionBoard.errors[9744405].message }}

HDRider

9 years ago

Try manually searching for and deleting it - Tutorial here

Skip installing AVG or delete your antivirus first, can't have two running, sometimes they fight each other.

[ 1 ] Thanks
2 replies

Signature

~ Ultra Fast Product Creation - Creating your own products is where the real money is... Let me show you how in this step by step guide.

~ Get Your Mind Right and Everything Else is Easy! Law of Attraction States...You Attract What You Think About.

{{ DiscussionBoard.errors[9744411].message }}

SandyDuPlessis 9 years ago

Deleted - message duplicated
- Thanks
- 1 reply
Signature

WSO - You Need To Add Or Improve On This One Element Of Your Business
And Your Income Will Explode! - Video Is Your Secret Weapon
{{ DiscussionBoard.errors[9744452].message }}
- andreas32123 9 years ago
  
  stay there and fiht
  
  Thanks
  
  Signature
  
  Entrepreneur 2014
  
  {{ DiscussionBoard.errors[9744717].message }}

SandyDuPlessis

9 years ago

@ HDRider - Thanks will try it on the PC. though I do not send or receive any emails on it. I do all my emailing on my iMac.

Edit:

Have checked according to that tutorial, but the PC is clean.

Whatever the problem is, it is on my Mac.

Thanks
1 reply

Signature

WSO - You Need To Add Or Improve On This One Element Of Your Business
And Your Income Will Explode! - Video Is Your Secret Weapon

{{ DiscussionBoard.errors[9744457].message }}

Joe Mobley

9 years ago

Until you clear up your Mac, you can't send emails from your PC?

Joe Mobley

Originally Posted by SandyDuPlessis

@ HDRider - Thanks will try it on the PC. though I do not send or receive any emails on it. I do all my emailing on my iMac.

Edit:

Have checked according to that tutorial, but the PC is clean.

Whatever the problem is, it is on my Mac.

Thanks
1 reply

Signature

.

Follow Me on Twitter: @daVinciJoe

{{ DiscussionBoard.errors[9744802].message }}

SandyDuPlessis

9 years ago

Originally Posted by Joe Mobley

Until you clear up your Mac, you can't send emails from your PC?

Joe Mobley

@ Joe - Nope! The only way I can send them at the moment is online via my server so that my IP is not involved..

Thanks
1 reply

Signature

WSO - You Need To Add Or Improve On This One Element Of Your Business
And Your Income Will Explode! - Video Is Your Secret Weapon

{{ DiscussionBoard.errors[9744849].message }}

seasoned

9 years ago

Originally Posted by SandyDuPlessis

@ Joe - Nope! The only way I can send them at the moment is online via my server so that my IP is not involved..

I forgot to say SOMETIMES ISPs close ports, and disable your ability to send email to other servers. That doesn't mean your system has been sending spam. They do this because SOME people use a promiscuous email server called an OPEN RELAY. Once you do THAT, all servers accepting email from them will blindly accept it from you. Of course, they record the senders IP, and their ISP could get some trouble.

Steve

[ 1 ] Thanks
1 reply

{{ DiscussionBoard.errors[9744880].message }}

SandyDuPlessis

9 years ago

@Steve,

Yikes! Now I am getting confused.

I do have a static IP address. I have a mac, so make use of Mac/Apple Mail to deal with my emails.

I don't appear to have any problems using gmail addresses via Apple Mac mail, only with those emails that I send making use of my website email addresses e.g. sandy@mysite.com. On the other hand, if I go into webmail then I am able to send the mails without a problem.

Thanks

Thanks
1 reply

Signature

WSO - You Need To Add Or Improve On This One Element Of Your Business
And Your Income Will Explode! - Video Is Your Secret Weapon

{{ DiscussionBoard.errors[9744905].message }}

seasoned

9 years ago

Originally Posted by SandyDuPlessis

@Steve,

Yikes! Now I am getting confused.

I do have a static IP address. I have a mac, so make use of Mac/Apple Mail to deal with my emails.

I don't appear to have any problems using gmail addresses via Apple Mac mail, only with those emails that I send making use of my website email addresses e.g. sandy@mysite.com. On the other hand, if I go into webmail then I am able to send the mails without a problem.

Thanks

The concept of how email is processsed, and static IPs is the same regardless of the make of the computer, or OS. With the "mac/apple mail", did it ask for a POP or SMTP address? If so, it is a CLIENT. Are you running the "mysite.com" site http server on your mac, or on a remote server? If it is on the remote server, then your email likely is ALSO. BTW if you don't know if it is on a remote server, if it is not on a remote server, your local system would have to remain on to allow round the clock access to your website.

Steve

Thanks
1 reply

{{ DiscussionBoard.errors[9745104].message }}

SandyDuPlessis

9 years ago

Originally Posted by seasoned

The concept of how email is processsed, and static IPs is the same regardless of the make of the computer, or OS. With the "mac/apple mail", did it ask for a POP or SMTP address? If so, it is a CLIENT. Are you running the "mysite.com" site http server on your mac, or on a remote server? If it is on the remote server, then your email likely is ALSO. BTW if you don't know if it is on a remote server, if it is not on a remote server, your local system would have to remain on to allow round the clock access to your website.

Steve

Yes, mac/apple mail is a client

and yes, my sites are all on a remote server .

Thanks

Signature

WSO - You Need To Add Or Improve On This One Element Of Your Business
And Your Income Will Explode! - Video Is Your Secret Weapon

{{ DiscussionBoard.errors[9745134].message }}

onSubie

9 years ago

Oh thanks- I didn't know about the CBL.

I don't have a lot of anti-virus protection on my PC so if I get a problem (happens rarely) then I usually use Google and the name of the file/virus to find solutions.

Thanks

{{ DiscussionBoard.errors[9744430].message }}

yakim1

9 years ago

I believe you don't have a trojan on your computer. I believe you are a victim of spooking.

What I think is happening to you is someone is using your return email address in spam emails being sent out from another server. When people complain you are viewed as the person sending the emails and the bounces come to your server or computer.

The only cure I have found is to delete the from email address you are currently using and use a different email address. The bounces will stop coming back to you and you can then begin the process of trying to get removed from black listes.

Keep in mind the black lists that want to charge you money to remove the black list may not be black lists that very many ISPs use. So you may not want un list from all of them.

I hope this has been helpful,
Steve Yakim

[ 1 ] Thanks
2 replies

{{ DiscussionBoard.errors[9744514].message }}

SandyDuPlessis 9 years ago

Steve, thank you.

I have never heard of Spooking before. Changing my email addresses might be a problem, but I will work something out.

Hopefully it will solve my problem.
- Thanks
Signature

WSO - You Need To Add Or Improve On This One Element Of Your Business
And Your Income Will Explode! - Video Is Your Secret Weapon
{{ DiscussionBoard.errors[9744666].message }}
Karen Blundell 9 years ago

Sandy, good to hear your problem has been cleared up by your ISP changing your IP address. Not sure how this happened to you in the first place, however, I would advise you to never post your email address anywhere in any forums, or social media sites -

Take care out there
- [ 1 ] Thanks
Signature
---------------
{{ DiscussionBoard.errors[9880771].message }}

Dan Riffle

9 years ago

Run Malware Bytes. (You probably already have, but run it again.)

Then go here and request help:
Malware Removal Assistance | MalwareTips.com

I recently had a problem with a virus I just couldn't beat. They had me fixed up in less than 24 hours.

Of course, this will not help you if your address has been spooked.

[ 2 ] Thanks
1 reply

Signature

Raising a child is akin to knowing you're getting fired in 18 years and having to train your replacement without actively sabotaging them.

{{ DiscussionBoard.errors[9744684].message }}

SandyDuPlessis 9 years ago

Hi Dan,

I ran it several times on the PC, but can't do so on the mac.
- Thanks
- 1 reply
Signature

WSO - You Need To Add Or Improve On This One Element Of Your Business
And Your Income Will Explode! - Video Is Your Secret Weapon
{{ DiscussionBoard.errors[9744691].message }}
- Dan Riffle 9 years ago
  
  Originally Posted by SandyDuPlessis
  
  Hi Dan,
  
  I ran it several times on the PC, but can't do so on the mac.
  
  It probably won't pick it up, but the guys at Malware Tips will want to see the logs. They will then point you in the direction you need to go. It may feel like a bit of a confusing process, but they'll get you sorted out.
  
  Thanks
  
  Signature
  
  Raising a child is akin to knowing you're getting fired in 18 years and having to train your replacement without actively sabotaging them.
  
  {{ DiscussionBoard.errors[9744699].message }}

seasoned

9 years ago

Sandy,

There are a number of different ways this can happen. But I DOUBT you mean IP, unless you have a fixed IP address. If you don't, they can't very well block the IP. And they never block the IP of the client anyway, it is of the server. If you DON'T have a fixed IP address, your system is likely the CLIENT. This is usually the case. Outlook, Pegasus, and the like are clients. People DO sometimes infect clients, but servers are often infected as well. Did you check the IP chain in a raw email of the spam? Did you check with the email provider yet? The email provider is NOT always the ISP. I, for example, have a gmail.com, a Reagan.com, outlook.com(NOT to be confused with outlook, which is the client), and OTHER email providers. BTW outlook,com is a Microsoft domain that likely uses a popular email server called exchange.

There IS a good chance the problem is not YOURS! MOST client infections do things like go through the users contact list and send emails via the users email.

Steve

[ 1 ] Thanks

{{ DiscussionBoard.errors[9744874].message }}

Floyd Fisher

9 years ago

I'm going to be really honest here.

About the only thing I can think of in this situation is to simply wipe the entire hard drive out and start over.

Wish I could help you further, but sometimes starting over is the best thing to do.

Thanks
1 reply

{{ DiscussionBoard.errors[9744975].message }}

SandyDuPlessis

9 years ago

Originally Posted by Floyd Fisher

I'm going to be really honest here.

About the only thing I can think of in this situation is to simply wipe the entire hard drive out and start over.

Wish I could help you further, but sometimes starting over is the best thing to do.

Ouch, that is definitely not what I want to hear, but will do so if I am forced to.

Thanks

Signature

WSO - You Need To Add Or Improve On This One Element Of Your Business
And Your Income Will Explode! - Video Is Your Secret Weapon

{{ DiscussionBoard.errors[9745078].message }}

seasoned

9 years ago

You're not going to stop spoofing, outside of tracking the origin, and asking the servers to tighten things. Many servers don't check, and some just check the user. If it checks the user and domain, spoofing will be impossible with that server.

Did you check for the IP in the spams IP list? If it is an IP from your client, the problem is there. If it from your server, it is there. If neither, it is likely spoofed. Of course, there is other evidence there as well. But where it starts is where the problem is. If you don't believe, and the spam is constant, just turn off your client at a given time. If you get spam sent after that time, the problem is elsewhere.

BTW setting up your system from scratch could take a long time.

Steve

Thanks

{{ DiscussionBoard.errors[9745162].message }}

SandyDuPlessis

9 years ago

03h30 over here and I am flagging, thanks for all the help and advice so far, will get back to you after a couple of hours sleep.

Thanks
1 reply

Signature

WSO - You Need To Add Or Improve On This One Element Of Your Business
And Your Income Will Explode! - Video Is Your Secret Weapon

{{ DiscussionBoard.errors[9745175].message }}

Joe Mobley 9 years ago

I was thinking about that. Enjoy the sleep.

Joe Mobley

Originally Posted by SandyDuPlessis

03h30 over here and I am flagging, thanks for all the help and advice so far, will get back to you after a couple of hours sleep.
- Thanks
- 1 reply
Signature

.
Follow Me on Twitter: @daVinciJoe
{{ DiscussionBoard.errors[9745189].message }}
- Joe Mobley 9 years ago
  
  And??? How's it going Sandy?
  
  Joe Mobley
  
  Thanks
  
  1 reply
  
  Signature
  
  .
  Follow Me on Twitter: @daVinciJoe
  
  {{ DiscussionBoard.errors[9750662].message }}
  
  SandyDuPlessis 9 years ago
  
  Hi Joe,
  
  Got hold of my host and they have activated SPF for me. This is supposed to help but I now need to wait 24 hours or so to see if it is working. Meanwhile I am also studying up on what I must do re DMARC in the event that SPF does not work.
  
  So once more it is a waiting game, but at least thanks to you guys, it has given me something to follow up on.
  
  Will report back as and when I know more.
  
  [ 1 ] Thanks
  
  Signature
  
  WSO - You Need To Add Or Improve On This One Element Of Your Business
  And Your Income Will Explode! - Video Is Your Secret Weapon
  
  {{ DiscussionBoard.errors[9751718].message }}

SandyDuPlessis

9 years ago

Update:

Activation of SPF has not worked for me. Will now try using DMARC, though feeling a bit confused by it.
If anyone has any other ideas I would greatly appreciated it.

[ 1 ] Thanks
1 reply

Signature

WSO - You Need To Add Or Improve On This One Element Of Your Business
And Your Income Will Explode! - Video Is Your Secret Weapon

{{ DiscussionBoard.errors[9767712].message }}

SandyDuPlessis 9 years ago

To those of you who have tried to help and who have been so supportive, I would like to bring you up to date.

It turned out that I was on a dynamic IP and not a static one. After a bit (ok, a lot) of nagging my internet provider changed my IP.

After several days of checking my IP with CBL, I am still clear. No more blacklist.

Thanks everybody

All the best

Sandy
- [ 2 ] Thanks
Signature

WSO - You Need To Add Or Improve On This One Element Of Your Business
And Your Income Will Explode! - Video Is Your Secret Weapon
{{ DiscussionBoard.errors[9880750].message }}

Paul Myers

9 years ago

Karen,

With this situation, it has nothing to do with her email address. Someone else ended up using the same IP she had used, and their machine was infected.

Cutwail is a huge botnet that was sending billions of spams daily at one point. Probably still is, although compromised servers are a bigger issue now in that area. If you're ever curious about just how dangerous these things can be, Google Cutwail. It's infected over a million machines.

BTW... Wombat alert: It's spoofing, not "spooking."

Paul

[ 2 ] Thanks
1 reply

Signature

.
Stop by Paul's Pub - my little hangout on Facebook.

{{ DiscussionBoard.errors[9880987].message }}

Karen Blundell 9 years ago

thanks, Paul, for the clarification -
I've been reading up on it - holy moly - crazy stuff!
- Thanks
Signature
---------------
{{ DiscussionBoard.errors[9884402].message }}

I am getting desperate - Advice needed from techy members re spam sending email trojan

Trending Topics

Newbie

How did you turn it all around?

A healthy fascination for Hollywood...

best high quality crypto traffic.

Any thoughts on golf's latest phenom...Scottie Scheffler??