CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

Intermittent failure and strange mail address

 
Post new topic   Reply to topic       All -> FavForums -> Internet Connectivity [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
garys1937

Cadet
Cadet


Joined: Nov 09, 2004
Posts: 1
Location: USA

PostPosted: Tue Nov 09, 2004 10:16 pm    Post subject: Intermittent failure and strange mail address
Reply with quote

From time to time, I lose both web and e-mail connections (I use IE and OE on XP Home Ed). The last time, both stayed down for nearly two weeks. Naturally, the day before my ISP made its trouble call, the system mysteriously and spontaneously cured itself.
Almost invariably, I find that something has changed my mail address from what it should be to 127.0.0.1, an address that neither I nore my ISP recognizes. Also, it sometimes changes my password from the proper number of characters to a great many more.
I have tried typing that strange address in the IE address bar. It converts to "127.0.0.1:1389/" and gives me a "This page cannot be displayed" message.
When my system is down, and I type an email message offline and try to send it, naturally it fails. Not so naturally, I later receive an error message that a message in my Outbox cannoty be sent because it has an invalid account.
When my system first restored itself yesterday, I had web access, but OE would not receive the new messages on the ISP's webmail Inbox. Later, I received a message that my settings had changed and prompted me to hit the "Restore now" button. Trouble is, it restored a POP3 account I haven't used in 2 years and made it the default. When I eliminated it, automatically making my correct account the default, it started downloading the "missing" email messages.
Does anyone have any idea what's going on?

Back to top
View users profile Send private message
Paul

CastleCops Founder


Joined: Feb 22, 2002
Posts: 27351

Administrators Firetrust Forums Admin MIRT Moderators MVP Phishing Squad Premium Team CC Committee

PostPosted: Fri Nov 12, 2004 2:05 pm    Post subject:
Reply with quote

Who is your ISP?


_________________
Paul Laudanski - http://www.laudanski.com
http://www.linkedin.com/pub/1/49a/17b
Back to top
View users profile Send private message Send email Visit posters website
HighWirez

Lieutenant
Lieutenant


Joined: Nov 12, 2004
Posts: 157
Location: USA

PostPosted: Sun Nov 14, 2004 4:20 am    Post subject:
Reply with quote

The address it keeps changing to is called a home or local machine address...basically an internal IP address which loops to your machine.

I have seen some antivirus programs and other programs that are set up to scan and/or monitor email do this. I have seen server versions of AVG do it and a mcafee product called dr. solomon's do it.

If this is what is affecting it...either an antivirus or some other program monitoring your email you should see if there is a fix for it.

The times I have seen it, it has been an incompatibility with whichever version and the operating system. Such as when a server we have went berzerk one day and AVG started itself 18 times. It was a lot of fun.

Anyway. I would make sure you have all necessary updates for your operating system (assuming you can get online) and that you have current versions of any spyware antivirus or email monitors and that they are compatible with your operating system.

Hope you get it sorted!

Good Luck!


_________________
M$
Keep it lean, keep it mean.
Back to top
View users profile Send private message
ZippyZingo

General
General
Premium Member

Joined: Apr 07, 2004
Posts: 3690
Location: USA
Premium

PostPosted: Mon Nov 15, 2004 10:35 pm    Post subject:
Reply with quote

I have also seen malware do this. Using 127.0.0.1 allows the malware to take over and insert what ever it wants.

Along with Highwirez suggestions, I would suggest that you run some checks for spyware/ adware. I have taken the liberty of stealing some directions from another staff member, Bill Bright. They may be of service too. (Thanks Bill.)
_______________
In Internet Explorer, go to Tools, Internet Options, General tab. Select Delete Cookies, and then Delete Files to delete all your temporary Internet files (Note, this also will force the manual entry of unames and passwords for sites requiring them on your next visit, so make sure you know them). If using Mozilla Firefox, go to Tools, Options, Privacy, and Clear All. We do this as there is no need to scan thousands of temporary files.

For Windows Me and XP users, as an option, you might consider temporarily turn off System Restore to enable the scanners to clean any infected restore images. See here for instructions. This keeps malware hiding in restore images from coming back and re-infecting your systems. It may also be the reason for spyware scanners finding the same spyware over and over again. If that is happening, you should consider this option. IMPORTANT: This option removes all past restore point images.

Now scan for spyware. To ensure you have the latest scanner versions, download and install SpyBot Search and Destroy V1.3 from here. Before scanning, use the program’s update option to get the latest signature files, and then scan. Note: If you have been using SpyBot S&D for some time, chances are you have version 1.2. For some unknown reason, the 1.2’s update feature does not alert you to the new version so you must download and install Version 1.3 from the link above.

Then download and install the latest version of AdAware SE from here. Before scanning, use the program’s update option to get the latest signature files, and then scan.

a² Free is also a good spyware/Trojan cleaner and can be downloaded from here. As before, get the latest signatures files first, and then scan.

Trojan Hunter is well liked too and a 30-day trial version is available here.

Use one of these free on-line virus scanners. Some very malicious malware have been known to disable PC based AV scanners.

Trend Micro HouseCall
or
PandaSoft ActiveScan

If you are not using a software based firewall, get one NOW! ZoneAlarm from ZoneLabs here is a favorite.

Some folks prefer Sygate Personal Firewall from here.

NOTE: For XP users, Microsoft's ICF (Internet Connection Firewall) and Windows Firewall (ICF renamed in XP SP2) are woefully inadequate and should be replaced immediately. They only block unauthorized incoming access attempts. ZoneAlarm and Sygate block unauthorized incoming and outgoing access thus preventing Trojans, keyloggers, and other spyware from "phoning home" with your personal information. Do not use more than one software based firewall.

While were talking about firewalls, if you are not using a NAT router, you should. The NAT acts as a very effective, hardware based, firewall. There are several offerings for under $50.00USD. Some offer dial-up support.

If you disabled System Restore, re-enable it now.
________________

ZZ

Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Internet Connectivity All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer