Inbox hijacked by spyware

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I have a user who installed some spyware that has hijacked the inbox. Everytime a user tries to view the inbox, they are forwarded to a website search engine. I am unable to find the site name in the registry. Any clues where outlook is getting the webpage address and how it is being forwarded?
 
Try looking at the folder properties -- it might be set up as a folder home
page.
--
Sue Mosher, Outlook MVP
Author of
Microsoft Outlook Programming - Jumpstart for
Administrators, Power Users, and Developers



Campanella Joe said:
I have a user who installed some spyware that has hijacked the inbox.
Click to expand...
Everytime a user tries to view the inbox, they are forwarded to a website
search engine. I am unable to find the site name in the registry. Any
clues where outlook is getting the webpage address and how it is being
forwarded?
 
Lets start with unplugging the machine from the network before you do some
serious damage.
Like you said; it's spyware! So Outlook doesn't do anything it's the spyware
doing so.
Either use an anti spyware program like Add Aware or rebuild the machine
(don't we all just love spyware? :-S)

--
Roady
www.sparnaaij.net
Microsoft Office and Microsoft Office related News
Also Outlook FAQ, How To's, Downloads and more...

Tip of the month:
-Tips for cleaning up your mailbox

Subscribe to the newsletter to receive news and tips & tricks in your
mailbox!
www.sparnaaij.net

(I changed my reply address; remove all CAPS and _underscores_ from the
address when mailing)
-----
Campanella Joe said:
I have a user who installed some spyware that has hijacked the inbox.
Click to expand...
Everytime a user tries to view the inbox, they are forwarded to a website
search engine. I am unable to find the site name in the registry. Any
clues where outlook is getting the webpage address and how it is being
forwarded?
 
Sue, it's not that. I have a customer who has this also and it has taken so much of my time

First, it was mysearch.com. We blocked at the Firewall. Now it's ask.com

1) I've run virtually every anti-spyware program
2) I've scoured the registry
3) I've checked to see if the folders have web pages assigned
4) The problem doesn't happen until you visit Outlook Today. If you start in the Inbox, you're alright, until you visit the Outlook Today page
5) I've changed Outlook profiles
6) I've re-installed Office
7) I've examined the Host files
8) I've started Outlook with various switches, like /Safe and /ResetOutlookBar, et al

The folders in the folder list display their contents only for a brief second, then they display a web page

Any clues

Thanks

To
 
Tom Alan said:
1) I've run virtually every anti-spyware program.
2) I've scoured the registry.
3) I've checked to see if the folders have web pages assigned.
4) The problem doesn't happen until you visit Outlook Today. If you start
Click to expand...
in the Inbox, you're alright, until you visit the Outlook Today page.
5) I've changed Outlook profiles.
6) I've re-installed Office.
7) I've examined the Host files.
8) I've started Outlook with various switches, like /Safe and
Click to expand...
/ResetOutlookBar, et al.

Have you tried spybot and cws shredder?

http://www.spywareinfo.com/~merijn/cwschronicles.html

http://www.pcworld.com/downloads/file_description/0,fid,22262,00.asp
(spybot)
 
Have you checked the properties for the Outlook Today folder and the source
for whatever HTML page it's pointing to? Outlook version?
--
Sue Mosher, Outlook MVP
Author of
Microsoft Outlook Programming - Jumpstart for
Administrators, Power Users, and Developers



Tom Alan said:
Sue, it's not that. I have a customer who has this also and it has taken so much of my time.

First, it was mysearch.com. We blocked at the Firewall. Now it's ask.com.

1) I've run virtually every anti-spyware program.
2) I've scoured the registry.
3) I've checked to see if the folders have web pages assigned.
4) The problem doesn't happen until you visit Outlook Today. If you start
Click to expand...
in the Inbox, you're alright, until you visit the Outlook Today page.
5) I've changed Outlook profiles.
6) I've re-installed Office.
7) I've examined the Host files.
8) I've started Outlook with various switches, like /Safe and /ResetOutlookBar, et al.

The folders in the folder list display their contents only for a brief
Click to expand...
second, then they display a web page.
 
Yes, Sue. Thank you. This is a very frustrating issue for my customer, and very time consuming for me

It's Office XP and the folders aren't being redirected based on values in the Home Page address field; they've all been checked and are blank

This hijack is much more insidious than that. Every anti-spyware program that I can think of has been run on that machine, and Office has been reinstalled, to no avail.
 
I had the same problem but I did get Ask Jeeves to stop.
Here is what I did:
1 - Searched the whole computer for a file with the
string "ask.com" (It showed in the address window on
Outlook)
2 - Only one file was found on the system - Eshop.xml.
3 - I renamed the file (so I can put it back if needed).
4 - Restarted and now the issue is gone.

However, this did not really fix the problem. I just
broke the link so that the website doesn't start. It
still tries to start. Does anyone know how to fix the
root of the problem, because actually now we have another
problem. Whenever Outlook starts, Word also starts (and
we have reply that we agree to the license). Maybe they
are different issues.
 
Back
Top