Question Locked

Spam sent from my computer

0 helpful
3 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a customer who has gotten her AOL account suspended due to spam supposedly coming from her account. She called AOL and they verified it.

She then switched to Juno. Shortly after, she got a warning from Juno! I have scanned this machine with Ewido, AdAware, Spybot, Nod32, Etrust EZ AV and probably several others, and I can't find anything! So, I have a couple questions:

1) If I were trying to catch outgoing spam, what would I look for using something like TDImon from Sysinternals?
2) How can I tell if spam really is coming from her physical computer?
3) Do you have any other suggestions?

I don't want to give her the computer back saying "I don't know whats going on. I couldn't find anything". Since she was sent to an "expert" by AOL to have it ironed out, I think its my duty come up with a difinitive answer.

Thanks!

Brian

3 replies

by mjd420nova

With the machine turned off, disconnect the LAN cable or turn of any WIFI router. Power the machine on and look for any errors. Also look at the task manager to see what is attempting to connect to the web. Most often, a trojan or worm has been installed and will attempt to call home on boot up to contact the spammers bots to get a new batch of spam to send out. The most common situation was a spoofed web site asking for username and password to AOL. These sites a clever and look like the real thing. The cure is to contact AOL and change the password and forgotten password clue entries. This should be done over the phone only, not online.

by blckspder

Avast home anti virus software... Its free and it stays up to date with virus definitions. I have used it on numerous computers to find worms and trojans.. I have also used windows defender with much susccess. I was actually surprised with windows defender. I am a mac and linux user myself and never really cared much for windows.
http://www.avast.com

This discussion is closed to new replies.