Every time I send an email or post (outlook express, MSN, or message boards),
some web address links /junk is added to the top and bottom of the email (see
example below) I have done a virus scan and search on how to get rid of, but
cannot figure out what is going on. Can anyone advise wherethis is coming
from and how to get rid of.

Don

This is what shows up. The send message is test for message board, but the
received message has the additional junk links.

http://cards.funnystories.ru/288100 ;))))))))))))
http://cards.funnystories.ru/288100 ;))))))))))))
test for message board.

http://www.lovepostcards.net/288100 ;))))))))))))))))
http://www.lovepostcards.net/288100 ;))))))))))))))))

Don wrote:
> Every time I send an email or post (outlook express, MSN, or message boards),
> some web address links /junk is added to the top and bottom of the email (see
> example below) I have done a virus scan and search on how to get rid of, but
> cannot figure out what is going on. Can anyone advise wherethis is coming
> from and how to get rid of.
>
> Don
>
> This is what shows up. The send message is test for message board, but the
> received message has the additional junk links.
>
> hxxp://cards.funnystories.ru/288100 ;))))))))))))
> hxxp://cards.funnystories.ru/288100 ;))))))))))))
> test for message board.
>
> hxxp://xxx.lovepostcards.net/288100 ;))))))))))))))))
> hxxp://xxx.lovepostcards.net/288100 ;))))))))))))))))

When you post about malware sites, please munge the web addresses next
time as I've done above. This way some poor soul won't click on them.

Yes, you are apparently infested with some malware. I doubt there are
any funny stories you want to read in Russian. You need to clean up your
computer and your antivirus will not help.

Go through these general malware removal steps systematically -
http://www.elephantboycomputers.com/...moving_Malware

Include scanning with either Sysclean or Multi_AV, plus AVG Anti-Spyware
(formerly Ewido - http://www.ewido.net/en/) and follow instructions to
do all scans in Safe Mode.

When all else fails, run HijackThis and post your log in one of the
specialty forums listed at the link above (not here, please).

Standard caveat: If the procedures look too complex - and there is no
shame in admitting this isn't your cup of tea - take the machine to a
professional computer repair shop (not your local version of
BigStoreUSA). Please be aware that not all local shops are skilled at
removing malware and even if they are, your computer may be so infested
that Windows will need to be clean-installed. Have all your data backed
up before you take the machine into a shop.


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Malke,

Thank you for the information on how to get rid of this. I'll give the step
by step instructions a try tonight.
One additional question, I trust mulge means get rid of the active link, but
how do you do this. When I pasted the note contents in (I sent a note to
myself and it was black text rather than a blue active link) it showed black.
Please let me know how to do it the way you recommend so I don't mess up
again.
Don

"Malke" wrote:

> Don wrote:
> > Every time I send an email or post (outlook express, MSN, or message boards),
> > some web address links /junk is added to the top and bottom of the email (see
> > example below) I have done a virus scan and search on how to get rid of, but
> > cannot figure out what is going on. Can anyone advise wherethis is coming
> > from and how to get rid of.
> >
> > Don
> >
> > This is what shows up. The send message is test for message board, but the
> > received message has the additional junk links.
> >
> > hxxp://cards.funnystories.ru/288100 ;))))))))))))
> > hxxp://cards.funnystories.ru/288100 ;))))))))))))
> > test for message board.
> >
> > hxxp://xxx.lovepostcards.net/288100 ;))))))))))))))))
> > hxxp://xxx.lovepostcards.net/288100 ;))))))))))))))))
>
> When you post about malware sites, please munge the web addresses next
> time as I've done above. This way some poor soul won't click on them.
>
> Yes, you are apparently infested with some malware. I doubt there are
> any funny stories you want to read in Russian. You need to clean up your
> computer and your antivirus will not help.
>
> Go through these general malware removal steps systematically -
> http://www.elephantboycomputers.com/...moving_Malware
>
> Include scanning with either Sysclean or Multi_AV, plus AVG Anti-Spyware
> (formerly Ewido - http://www.ewido.net/en/) and follow instructions to
> do all scans in Safe Mode.
>
> When all else fails, run HijackThis and post your log in one of the
> specialty forums listed at the link above (not here, please).
>
> Standard caveat: If the procedures look too complex - and there is no
> shame in admitting this isn't your cup of tea - take the machine to a
> professional computer repair shop (not your local version of
> BigStoreUSA). Please be aware that not all local shops are skilled at
> removing malware and even if they are, your computer may be so infested
> that Windows will need to be clean-installed. Have all your data backed
> up before you take the machine into a shop.
>
>
> Malke
> --
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
> MS-MVP Windows - Shell/User
>

Stein wrote:
> Malke,
>
> Thank you for the information on how to get rid of this. I'll give the step
> by step instructions a try tonight.
> One additional question, I trust mulge means get rid of the active link, but
> how do you do this. When I pasted the note contents in (I sent a note to
> myself and it was black text rather than a blue active link) it showed black.
> Please let me know how to do it the way you recommend so I don't mess up
> again.

Just replace some of the letters like I did; i.e. hxxp instead of http,
xxx instead of www.


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Malke,

Thanks again for the information. I tried it last night and it worked!!!
After deleting the temp files, etc I installed sysclean and ran and then
installed ad-aware and ran.
After ad-aware was run, it said something about a rsvp_32.dll in the
system32 folder. I went in in safe mode and manually deleted and then also
opened (and saw the junk that was being added to the emails) and manually
deleted some other trash that was dated around the same time. After this my
emails were clean. I next have to run spybot tonight. I don't understand why
my norton and firewall didn't pick this up.

In any event, a big thank you for responding to my query and providing
directions. I printed and tucked them away in case I have to ever use them
again.
Don

"Malke" wrote:

> Stein wrote:
> > Malke,
> >
> > Thank you for the information on how to get rid of this. I'll give the step
> > by step instructions a try tonight.
> > One additional question, I trust mulge means get rid of the active link, but
> > how do you do this. When I pasted the note contents in (I sent a note to
> > myself and it was black text rather than a blue active link) it showed black.
> > Please let me know how to do it the way you recommend so I don't mess up
> > again.
>
> Just replace some of the letters like I did; i.e. hxxp instead of http,
> xxx instead of www.
>
>
> Malke
> --
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
> MS-MVP Windows - Shell/User
>

Don wrote:
> Malke,
>
> Thanks again for the information. I tried it last night and it worked!!!
> After deleting the temp files, etc I installed sysclean and ran and then
> installed ad-aware and ran.
> After ad-aware was run, it said something about a rsvp_32.dll in the
> system32 folder. I went in in safe mode and manually deleted and then also
> opened (and saw the junk that was being added to the emails) and manually
> deleted some other trash that was dated around the same time. After this my
> emails were clean. I next have to run spybot tonight. I don't understand why
> my norton and firewall didn't pick this up.
>
> In any event, a big thank you for responding to my query and providing
> directions. I printed and tucked them away in case I have to ever use them
> again.

I'm very happy that you've got this sorted and that I was able to help
you. Thanks for taking the time to post back. You may be interested in
looking at some of these links to help Stay Safe in the future:

http://www.wilderssecurity.com/showthread.php?t=27971 - So How Did I Get
Infected Anyway?
http://www.getsafeonline.org/
http://wiki.castlecops.com/Malware_R...:_Introduction
http://www.claymania.com/safe-hex.html
http://www.aumha.org/a/parasite.htm - The Parasite Fight


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User