879345 - Trojan is attacking TBIRD Settings

Status: RESOLVED INVALID

(Thunderbird :: Untriaged, defect)

Description

[Dan Perley]

User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; MDDC; MS-RTC LM 8; AskTbORJ/5.14.1.20007)

Steps to reproduce:

Tried to send E-Mail


Actual results:

1.    Beware a new rogue trojan which is apparently able to evade even Kaspersky and got into my TBIRD settings and changed the outgoing SMTP port number and then tried to spoof another site as acquiring the identity of my E-Mail server.   TBIRD then asks you to approve a security exception for a site which is unable to provide a proper certificate, but also warns you that this is highly suspicious.

2.    It just took 40 minutes with Rogers to diagnose the problem. 

>>> If this happens, go over your ingoing and outgoing SMTP server settings very carefully and double-check port numbers.  Then go onto your E-Mail provider wiht the Web browser client and change your password on that server, as well as in your TBIRD client.

Comment 1

[Daniel Veditz [:dveditz]]

Unfortunately once malware is loose on your machine it can fiddle with the settings of any program and there's not much any software can do.