6 replies to this topic

[kara]

Help, I have scanned my computer 4 times and still cannot get rid of the Adware. It's affecting my yahoo email account with some German bank ad and I cannot reply to emails...among other problems. Here is my last scan log:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/21/2010 at 08:02 PM

Application Version : 4.43.1000

Core Rules Database Version : 5553
Trace Rules Database Version: 3365

Scan type : Complete Scan
Total Scan Time : 00:34:59

Memory items scanned : 367
Memory threats detected : 0
Registry items scanned : 9411
Registry threats detected : 0
File items scanned : 34484
File threats detected : 36

Adware.Tracking Cookie
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@adecn[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@kontera[1].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@doubleclick[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@s.clickability[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@mediaplex[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@revsci[1].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@serving-sys[1].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@zedo[1].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@ad.yieldmanager[3].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@adbrite[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@specificmedia[1].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@apmebf[3].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@advertising[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@ads.pointroll[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@content.yieldmanager[5].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@bs.serving-sys[1].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@www.matracking[1].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@fastclick[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@questionmarket[3].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@www.googleadservices[3].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@mediaplex[1].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@questionmarket[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@realmedia[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@trafficmp[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@ad.yieldmanager[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@invitemedia[4].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@2o7[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@statcounter[1].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@a1.interclick[3].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@tribalfusion[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@cbs.112.2o7[1].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@invitemedia[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@tacoda[2].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@imrworldwide[1].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@network.realmedia[1].txt
C:\Users\kjendersee\AppData\Roaming\Microsoft\Windows\Cookies\kjendersee@adecn[1].txt

[Seth]

Welcome to the SAS forum Kara, and thanks for the log.

The log doesn't show any relevant infections, but rather tracking cookies. Please see here:

http://www.superanti...lay.html?faq=26

It seems your Yahoo email account may have been hacked.

Please provide more specific information regarding your email issues.

[kara]

Welcome to the SAS forum Kara, and thanks for the log.

The log doesn't show any relevant infections, but rather tracking cookies. Please see here:

http://www.superanti...lay.html?faq=26

It seems your Yahoo email account may have been hacked.

Please provide more specific information regarding your email issues.

Thanks for your response. My issues with my email are either not being able to reply or I reply and it inserts what looks to be an ad for a bank in German in the bulk of my email reply. I replied to my husbands email yesterday and he said it came with an attachment for the same "bank". Should I just get rid of my yahoo mail? Do you know if there is another way to "un-hack" it?

[kara]

Thanks for your response. My issues with my email are either not being able to reply or I reply and it inserts what looks to be an ad for a bank in German in the bulk of my email reply. I replied to my husbands email yesterday and he said it came with an attachment for the same "bank". Should I just get rid of my yahoo mail? Do you know if there is another way to "un-hack" it?

This is what is showing up on my email replies, but it's in an ad form:


wir stellen uns auf eine neue online Banking um !
--------------------------------------------------------------------------------

Zur Zeit befindet sich eine neue Online Banking Anwendung in der Testphase, wodurch einige Kundendaten teilweise beschädigt wurden. Aus diesem Grund bitten wir Sie 50 TAN's einzugeben, damit Sie Online Banking weiterhin nutzen könnten:



02 12 22 32 42
01 11 21 31 41
04 14 24 34 44
05 15 25 35 45
03 13 23 33 43
06 16 26 36 46
07 17 27 37 47
10 20 30 40 50
08 18 28 38 48
09 19 29 39 49

52 62 72 82 92
51 61 71 81 91
53 63 73 83 93
57 67 77 87 97
56 66 76 86 96
54 64 74 84 94
55 65 75 85 95
60 70 80 90 100
58 68 78 88 98
59 69 79 89 99







Bild hochladen:


Hier gehr es weiter um iTan Liste manuell auszufullen :




--------------------------------------------------------------------------------

Achtung ! Es wird nie eine oder mehrere iTans per email oder telefonisch von unseren Mitarbeitern abgefragt !

[Seth]

This is what is showing up on my email replies, but it's in an ad form:


wir stellen uns auf eine neue online Banking um !
--------------------------------------------------------------------------------

Zur Zeit befindet sich eine neue Online Banking Anwendung in der Testphase, wodurch einige Kundendaten teilweise beschädigt wurden. Aus diesem Grund bitten wir Sie 50 TAN's einzugeben, damit Sie Online Banking weiterhin nutzen könnten:



02 12 22 32 42
01 11 21 31 41
04 14 24 34 44
05 15 25 35 45
03 13 23 33 43
06 16 26 36 46
07 17 27 37 47
10 20 30 40 50
08 18 28 38 48
09 19 29 39 49

52 62 72 82 92
51 61 71 81 91
53 63 73 83 93
57 67 77 87 97
56 66 76 86 96
54 64 74 84 94
55 65 75 85 95
60 70 80 90 100
58 68 78 88 98
59 69 79 89 99







Bild hochladen:


Hier gehr es weiter um iTan Liste manuell auszufullen :




--------------------------------------------------------------------------------

Achtung ! Es wird nie eine oder mehrere iTans per email oder telefonisch von unseren Mitarbeitern abgefragt !

[Seth]

This is what is showing up on my email replies, but it's in an ad form:


wir stellen uns auf eine neue online Banking um !
--------------------------------------------------------------------------------

Zur Zeit befindet sich eine neue Online Banking Anwendung in der Testphase, wodurch einige Kundendaten teilweise beschädigt wurden. Aus diesem Grund bitten wir Sie 50 TAN's einzugeben, damit Sie Online Banking weiterhin nutzen könnten:



02 12 22 32 42
01 11 21 31 41
04 14 24 34 44
05 15 25 35 45
03 13 23 33 43
06 16 26 36 46
07 17 27 37 47
10 20 30 40 50
08 18 28 38 48
09 19 29 39 49

52 62 72 82 92
51 61 71 81 91
53 63 73 83 93
57 67 77 87 97
56 66 76 86 96
54 64 74 84 94
55 65 75 85 95
60 70 80 90 100
58 68 78 88 98
59 69 79 89 99







Bild hochladen:


Hier gehr es weiter um iTan Liste manuell auszufullen :




--------------------------------------------------------------------------------

Achtung ! Es wird nie eine oder mehrere iTans per email oder telefonisch von unseren Mitarbeitern abgefragt !

[Seth]

I suggest you delete the account and create a new one.

http://email.about.c...ail_Account.htm

Following that, email the people on your contact list and warn them not to open emails from your old account.