HELP!!! Symantec_AntiVirus_for_SMTP

Please forgive me if I am posting in the wrong forum. This is the second time within a month when I have received emails like the one below form Symantec. They both seem to have susposedly been sent to Government offices from me. Which I have not sent! Is this a valid email from symantec, and what is causing this? Not sure what info you need, I have Spybot S&D and Adaware on my computer, other then these odd emails, my computer seems to be fine.

From : <Symantec_AntiVirus_for_SMTP_Gateways@cga.state.ct.us>
Sent : Sunday, May 9, 2004 12:44 PM
To : (MY EMAIL HERE)
Subject : Content violation

CT. General Assembly SMTPGATEWAY.
Content violation found in email message.

From: (MY EMAIL HERE)To: livvy.floren@housegop.state.ct.us

File(s): XXXXXXXXX.exe (A SET OF NINE NUMBERS, DIDNT WANT TO POST AND POSSIBLY CAUSE ANY PROBLEMS IN THE FORUM)
Matching filename: *.exe

 

follow the instructions at the link and then post a log as instructed. don't try to fix anything until an expert checks it for you.
https://www.wilderssecurity.com/showthread.php?t=15913

 

An do not click on those exe files......

 

I have run adaware, then also Spybot. Spybot came up empty, but then I went in and changed the items on which it should search, so as to get everything. There are alot of registry entries, and I wont touch those without someone telling me if its okay or not. Here is a listing of the last report I got with those items. Could someone tell me please what to fix before I run my HJT log. Thank you.... (ALL OF THESE ITEMS HAVE A RED EXCLAMATION MARK IN FRONT OF THEM)

--- Report generated: 2004-05-10 12:28 ---

Congratulations!: No immediate threats were found. ()

Windows Registry: C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1015.dll (Missing shared DLL, nothing done)
HDPlugin1015.dll

Windows Registry: C:\WINDOWS\Downloaded Program Files\HDPlugin1015.dll (Missing shared DLL, nothing done)
HDPlugin1015.dll

Windows Registry: OcrEngine.exe (Wrong app path, nothing done)


Windows Registry: Oregon Scientific Photo Album (Wrong app path, nothing done)


Windows Registry: Epp.exe (Wrong app path, nothing done)


Windows Registry: Copy.exe (Wrong app path, nothing done)


Windows Registry: Applet.exe (Wrong app path, nothing done)


Windows Registry: Pyth.exe (Wrong app path, nothing done)


Windows Registry: AppOcr.exe (Wrong app path, nothing done)


Windows Registry: AppFile.exe (Wrong app path, nothing done)


Windows Registry: yourapp.Exe (Wrong app path, nothing done)


Windows Registry: PdaConverter.exe (Wrong app path, nothing done)


Windows Registry: MsoHtmEd.exe (Wrong app path, nothing done)


Windows Registry: vphone.exe (Wrong app path, nothing done)
C:\PROGRA~1\COMMON~1\INTELS~1\H32X

Windows Registry: Createcd50.exe (Wrong app path, nothing done)


Windows Registry: key (Wrong app path, nothing done)


602Pro PC SUITE (602Photo v2001): Last open folder (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Software602\CDlg602\2001\602Photpen\InitialDir=

602Pro PC SUITE (602Tab v2001): Last used folder (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Software602\602Tab\Options\InitialDir=

602Pro PC SUITE (602Text v2001): Last open folder (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Software602\CDlg602\2001\602Text_OpenFile\InitialDir=

602Pro PC SUITE (602Text v2001): Last save folder (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Software602\CDlg602\2001\602Text_SaveFile\InitialDir=

602Pro PC SUITE (602Text v2001): Recent file list (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Software602\602text\2000\Settings\ResFiles

602Pro PC SUITE (602Text v2001): Recent OLE list (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Software602\602text\2000\Settings\ResOLE

ACDSee 5.0: Folder history (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\ACD Systems\ACDSee\50\HistPaths

ACDSee 5.0: Last opened folder (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\ACD Systems\ACDSee\50\OpenFolder=

Adobe Acrobat Reader 6: Recent file #1 (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cRecentFiles\c1

Adobe Acrobat Reader 6: Recent file #2 (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cRecentFiles\c2

Adobe Acrobat Reader 6: Recent file #3 (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cRecentFiles\c3

Adobe Acrobat Reader 6: Recent file #4 (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cRecentFiles\c4

Adobe Acrobat Reader 6: Recent file #5 (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cRecentFiles\c5

Creative Technologies: Albums history ( (2 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Creative Tech\CTAlbum

Internet Explorer: AutoComplete data ( (1 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\IntelliForms\SPW

Internet Explorer: Cookies ( (13 cookies)) (Directory, nothing done)
C:\WINDOWS\Cookies

Internet Explorer: Download directory (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Download Directory=

Internet Explorer: Last used directory (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Save Directory=

Internet Explorer: Temporary internet files ( (395 entries)) (Empty cache, nothing done)

Internet Explorer: User agent (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent=Mozilla/4.0 (compatible; MSIE; Win32)

Log: Activity: ModemDet.txt (Backup file, nothing done)
C:\WINDOWS\ModemDet.txt

Log: Activity: OEWABLog.txt (Backup file, nothing done)
C:\WINDOWS\OEWABLog.txt

Log: Activity: Sti_Trace.log (Backup file, nothing done)
C:\WINDOWS\Sti_Trace.log

Log: IE: brndlog.txt (Backup file, nothing done)
C:\WINDOWS\brndlog.txt

Log: Install: Active Setup Log.txt (Backup file, nothing done)
C:\WINDOWS\Active Setup Log.txt

Log: Install: Directx.log (Backup file, nothing done)
C:\WINDOWS\Directx.log

Log: Install: wmsetup.log (Backup file, nothing done)
C:\WINDOWS\wmsetup.log

Log: Shutdown: System\wbem\logs\winmgmt.log (Backup file, nothing done)
C:\WINDOWS\System\wbem\logs\winmgmt.log

MS Backup: Last used path (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Microsoft Backup\Settings\Default File Device Path=

MS Backup: Recent file list ( (1 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Microsoft Backup\Recent File List

MS ClipArt Gallery 9.0: Last import directory (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\ClipArt Gallery\ImportDirectory=

MS ClipArt Gallery 9.0: Recently used captions ( (7 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\ClipArt Gallery\2.0\MRUCaption

MS ClipArt Gallery 9.0: Used cliparts ( (2 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\ClipArt Gallery\2.0\MRUDescription

MS Direct3D: Most recent application (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name=

MS Direct3D: Most recent application (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name=

MS DirectDraw: Most recent application (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name=

MS DirectInput: Most recent application (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\DirectInput\MostRecentApplication\Name=

MS DirectInput: Most recent application ID (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\DirectInput\MostRecentApplication\Id=

MS Frontpage: Recent page list ( (1 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\FrontPage\Explorer\FrontPage Explorer\Recent Page List

MS Imaging: Recent file list ( (1 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Kodak\Imaging\Recent File List

MS Media Player: Last CD record path (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\CDRecordPath=

MS Media Player: Last opened playlist (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\LastPlaylist

MS Media Player: Last search folder (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\SearchPath=

MS Media Player: Last selected node (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MediaPlayer\MediaLibraryUI\MLLastSelectedNode=

MS Media Player: Last selected track index (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\LastPlaylistIndex

MS Media Player: Manually modified tags history ( (12 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MediaPlayer\AutoComplete\MediaEdit

MS Media Player: Recent file list ( (9 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MediaPlayer\Player\RecentFileList

MS Media Player: Recent open directory (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MediaPlayer\Player\Settings\OpenDir=

MS Media Player: Save as Directory (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MediaPlayer\Player\Settings\SaveAsDir=

MS Media Player: Search terms history (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MediaPlayer\AutoComplete\MediaSearch

MS Office 9.0 (Excel): Recent files ( (4 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\9.0\Excel\Recent Files

MS Office 9.0 (Script Editor): Last loaded solution (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MSE\9.0\LastLoadedSolution=

MS Office 9.0 (Script Editor): Last new project item location (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MSE\9.0\DefaultNewProjItemLocation=

MS Office 9.0 (Script Editor): Last new project location (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MSE\9.0\DefaultNewProjectLocation=

MS Office 9.0 (Script Editor): Last opened file location (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MSE\9.0\DefaultFileOpenLocation=

MS Office 9.0 (Script Editor): Last opened project item location (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MSE\9.0\DefaultOpenProjItemLocation=

MS Office 9.0 (Script Editor): Last opened project location (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MSE\9.0\DefaultOpenProjectLocation=

MS Office 9.0 (Script Editor): Most recent menu list ( (1 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MSE\9.0\MenuMRUList

MS Office 9.0 (Script Editor): Most recent project list ( (1 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\MSE\9.0\ProjectMRUList

MS Office 9.0 (Word): Recently used file list (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\9.0\Word\Data\Settings

MS Office 9.0: Access recent file ( (5 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\9.0\Access\Settings

MS Office 9.0: Internet history (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Office\9.0\Common\Internet\LocationOfComponents

MS Office 9.0: Recently used files ( (82 files)) (Directory, nothing done)
C:\WINDOWS\Application Data\Microsoft\Office\Recent\

MS Paint: Recent file list ( (2 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List

MS Photo Editor: Last used directory (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Photo Editor\3.0\File Options\Path=

MS Photo Editor: Recently used file #1 (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Photo Editor\3.0\Microsoft Photo Editor\LastFile1

MS Photo Editor: Recently used file #2 (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Photo Editor\3.0\Microsoft Photo Editor\LastFile2

MS Photo Editor: Recently used file #3 (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Photo Editor\3.0\Microsoft Photo Editor\LastFile3

MS Photo Editor: Recently used file #4 (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Photo Editor\3.0\Microsoft Photo Editor\LastFile4

MS Photo Editor: Recently used file type #1 (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Photo Editor\3.0\Microsoft Photo Editor\LastType1

MS Photo Editor: Recently used file type #2 (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Photo Editor\3.0\Microsoft Photo Editor\LastType2

MS Photo Editor: Recently used file type #3 (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Photo Editor\3.0\Microsoft Photo Editor\LastType3

MS Photo Editor: Recently used file type #4 (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Photo Editor\3.0\Microsoft Photo Editor\LastType4

MS WebPost wizard: Published sites history (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\WebPost\Sites

MS Wordpad: Recent file list ( (4 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

RealOne Player 2 (aka RealPlayer 6.0): Last login time (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\RealNetworks\RealPlayer\6.0\Preferences\LastLoginTime\=

RealOne Player 2 (aka RealPlayer 6.0): Last open file directory (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\RealNetworks\RealPlayer\6.0\Preferences\LastOpenFileDir\=

RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #1 (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips1\=

RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #2 (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips2\=

RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #3 (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips3\=

RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #4 (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips4\=

RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #5 (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips5\=

RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #6 (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips6\=

RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #7 (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips7\=

RealOne Player 2 (aka RealPlayer 6.0): Most recent clips #8 (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentClips8\=

RealOne Player 2 (aka RealPlayer 6.0): Most recent skins #1 (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\RealNetworks\RealPlayer\6.0\Preferences\MostRecentSkins1\=

Windows: Install locations ( (6 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\InstallLocationsMRU

Windows Explorer: Computer search history #1 ( (2 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FindComputerMRU

Windows Explorer: Document search history ( (2 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU

Windows Explorer: Recent file global history (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Windows Explorer: Recently opened files ( (11 links)) (Directory, nothing done)
C:\WINDOWS\Recent

Windows Explorer: Stream history ( (201 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Explorer: User Assistant history files ( (3 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

Windows Explorer: User Assistant history IE ( (518 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

Windows Media SDK: Computer name (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\ComputerName=ComputerName

Windows Media SDK: Unique ID (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\UniqueID={00000000-0000-0000-0000-000000000000}

Windows Media SDK: Volume serial number (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Network: Recent opened folder list (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Network\Recent

WinZip: Add files directory (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Nico Mak Computing\WinZip\directories\gzAddDir=

WinZip: Add files directory (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Nico Mak Computing\WinZip\directories\AddDir=

WinZip: Default directory (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Nico Mak Computing\WinZip\directories\zDefDir=

WinZip: Default directory (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Nico Mak Computing\WinZip\directories\DefDir=

WinZip: Destination directory (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Nico Mak Computing\WinZip\directories\gzExtractTo=

WinZip: Destination directory (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Nico Mak Computing\WinZip\directories\ExtractTo=

WinZip: Number of times run (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Nico Mak Computing\WinZip\rrs\Opened=

WinZip: Recent created file list ( (15 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Nico Mak Computing\WinZip\filemenu

WinZip: Recent extracted file list ( (1 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Nico Mak Computing\WinZip\extract

WinZip: Wizard Extraction folder history ( (10 files)) (Registry key, nothing done)
HKEY_USERS\.DEFAULT\Software\Nico Mak Computing\WinZip\select

Yahoo: Photo uploader directory (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Yahoo\YPhotos\LastPath=

 

For now we need to ignore the log that you have and you need to post a HJT log as the next step so the pro's can see what is going on. Go to the link and bypass the first test since you have run it and post a Hijackthis log. thank you just follow steps #2 and #3
bigc
https://www.wilderssecurity.com/showthread.php?t=15913

 

Posted HJT log in adware,spyware and hijack cleaning.

 

Hopefully if there is some malware there they will find it. our HJT people are pretty good.