Problem with Windows Live MailSolved/Closed

Question

Hello, 

I've got an e-mail account with blueyonder which I access using Windows Live Mail. Whenever I click on the Windows Live Mail icon it takes me straight to my inbox and automatically downloads any new messages. I do not have to log in and I have  never been asked for a password, and to the best of my knowledge have never had one.

For some strange reason when I attempted to access Windows Live Mail today I got a request for a pop3 password and it appears I can no longer receive messages without one. I therefore followed the procedure for setting up a new account. The procedure seemed to go ok but in order to activate it I have to verify my e-mail address by following the instructions in an e-mail they say they have sent me.

The problem I have got is that my e-mails will not download unless I log in first. I cannot log in without following the instructions in the e-mail they have sent me and I cannot access the e-mail they have sent me because I am unable to log in. So it appears I am in a vicious circle. As far as I can see it is not possible to have the verification e-mail sent to a different e-mail address to the one you are seeking to have verified.

Any assistance / suggestions would be appreciated.

Doit2it · Accepted Answer

I found a way to still use 2 step verification and get logged in.  Read the FAQ about creating an app password for Hotmail (2nd FAQ):
http://windows.microsoft.com/en-us/windows/two-step-verification-faq

Ambucias · Answer

Hello confusedcius

Let see if it is a virus or spyware:

To help you, I must make a diagnostic and to do so, I require a log. 

Open this link and download ZHPDiag : 

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html 


Register the file on your Desktop. 

Double click on ZHPDiag.exe and follow the instructions. 

the tool created two icons ZHPDiag and ZHPFix (we will use ZHPFix at the next step). 

Double click on the short cut ZHPDiag on your Destktop. 

Click on the Magnifying glass and run the analysys. 

Wait for the tool to finished (maybe a long time) 

Close ZHPDiag. 


To transmit the report, click on this link : 

https://authentification.site 

Click on Parcourir and search the directory where you installed ZHPDiag (usually C:\Program Files\ZHPDiag). 

Select the file ZHPDiag.txt. 

Click on "upload » 

Copy the url and post it here

Ambucias · Answer

Dear Confusedcius,

I have analysed and your system is badly infected.  There are virus segments in almost everywhere: rogue trojan horse (fake alert), spyware, adware, BT, etc.

You are using Norton Internet Security.  From a long experience, Symantec says that they are the best.  They are not and far from it and you are living proof.

Many of the infections your system have originated from your Torrent downloads.  Torrents are vastly a playground for those who create malware.  

Now lets start from the beginning to clean your system.

1. Go to your control panel/add remove programs.
2. Delete Bandoo (it's spyware)

3. Repeat the above for ask.com (spyware and adware)

4. Delete the Toolbar Babylon (adware)

5. Go the following location and delete this file (spyware) C:\Program Files\Freeze.com\NetAssistant\NetAssistant.dll

6. Go to this location and delete this adware: C:\Program Files\alot\bin\BHO\alotBHO.dll

7. C:\Program Files\Evidence Eliminator is a Trojan.  Please delete it.

8. Please delete:  iLivid 

9. Download, install and run Malwarebyte which you can find on this site: 

https://ccm.net/downloads/security-and-maintenance/4621-malwarebytes-anti-malware/ es-anti-malware 

Ensure you make an update.

Boot your computer in safemode

Please request a FULL system scan, which may take from 20 minutes to hours.  Do not interfere no matter how long in takes.  The creators of Malwarebyte recommend that while the tool is running that you go do something else, such as watching a rerun of Gone with the Wind or read Tolstoy's War and Peace.

If Malwarebyte restarts your system, launch it again to finish the Full scan. 

When the scan is completed, delete all items found.

Once your computer is clean and working normally just to be on the safe side 
*Turn off system restore and wait 30 seconds, 
*Turn it back on and create a new restore point. 

This way it gets rid of anything bad that might have gotten saved in a restore point and you have a clean restore point to use in the near future if needed. 
Do not turn it off until your computer is clean and working normally because you might need to use it if something goes wrong during the clean-up process. 
It is better to go back to an infected restore point if something goes wrong then to not be able to undo changes that were damaging.

Let me know after you complete the above

Good luck

confusedcius2 · Answer

Hi again Ambucias,

Thanks for the advice. I've followed all of your instructions. Malwarebyte found 16 infected items so I deleted them all.

Unfortunately it hasn't made any difference to the Windows Live Mail problem. I'm still getting the request for the username and password and that the email address has to be verified.

Anonymous User · Answer

Try to uninstall your antivirus,sometimes email scanning options in your antivirus  can block it

Ambucias · Answer

@ Confused

Make a search for Discordia.  Delete all the files showning the word Discordia.

Ensure that your ALOT Toolbar has been deleted

Finally, please download and run this rogue killer

https://www.bleepingcomputer.com/download/linux/

Last, please send me the Malwarebyte log.

Catch you later

confusedcius2 · Answer

Hello Ambucias,

Firstly, I ran a search for Discordia and it didn't find anything.

What I did discover, however, was that after typing the first three letters (dis) it brought up a list of what looked like spam. A small number of them were authentic emails that I recognised having being sent previously, but most of it looked like rubbish that was all created on 04.10.11, (the day the problem started). The location was : Users\John\AppData\Roaming\Microsoft\Windows\Recent.

What I then discovered is if I right clicked on each one and selected file location it took me to a whole list of them all created on 04.10.11. The location of these was : AppData>Local>Microsoft>WindowsLive Mail>YourFeeds.

I systematically deleted all the files created on 04.10.11 at both locations and there were 1,905.

After that I followed all your other instructions.

The links for the Malwarebyte logs are:

https://authentification.site/files/30611844/mbam-log-2011-10-05_13-18-28_.txt

https://authentification.site/files/30611859/mbam-log-2011-10-05_13-46-49_.txt

The problem remains.

Thanks for all your help to date.

Ambucias · Answer

Greetings Condusedcius,

It seems that Malwarebyte destroyed the Trojan.

I trust that you did run Smitfraudix.

There were some malware related to Adobe.

From what I see the system may be corrupted in part by other applications which you acquired through the peer to peer application. (torrent)

The ZHP Diag report did show much more infected registry keys than MBAM deleted.

I shall prescribe to you a very powerfull antidote that is able to kill and send any virus to the glue factory. It is of very last resort and should not be abused of, as matter of a fact, once you have used it, I suggest you delete it from your system. 

To keep your system safe, you must follow the instructions hereunder to the letter: First step, boot your system in safe mode with networking

1. Download Combofix to your desktop. 

http://www.combofix.org/download.php 

2.Close all open Windows including this one. 

Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix. 

3. Double click on the ComboFix icon. 

Windows is issuing this prompt because ComboFix does not have a digital signature. This is perfectly normal and safe and you can click on the Run button to continue. 

4. Accept the disclaimer and the recovery 

5.You should now press the Yes button to continue. If at any time during the Recovery Console installation you receive a message stating that it failed to install, please allow ComboFix to continue with the scan of your computer. 

ComboFix will disconnect your computer from the Internet, so do not be surprised or concerned if you receive any warnings stating that you are no longer on the Internet. When ComboFix has finished it will automatically restore your Internet connection. 

While the program is scanning your computer, it will change your clock format, so do not be concerned when you see this happen. When ComboFix is finished it will restore your clock settings to their previous settings. 

If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt. 

During the process, please do not mouse click nor must you tap on the keyboard.  Let the tool run.

Once you are done, report to me on how your system is behaving. 

Good luck 

Ambucias

confusedcius2 · Answer

Hi Ambucias,

I've tried to follow your instructions but unfortunately I've run into a problem.

Whenever I try to start my computer in safe mode with networking I get the following message : 

Cyberlink Power Recover
Driver initialization failed.
Please reinstall the application.

I did a search for Cyberlink and found three applications (Power Label, Power DVD, Power2Go), so I've uninstalled them. I've checked in the programmes in the uninstall list in the control panel, the programmes on the c drive, all programmes on the startup menu and also done another programme search and they all seem to have gone, but I'm afraid I am still getting the same message when I try to start in safe mode with networking.

Ambucias · Answer

Did you run Combofix?

confusedcius2 · Answer

Hi, 

No.  

Because you were very specific about following your instructions to the letter I didn't want to download, install or run Combofix in normal mode as I was afraid it might XXXX things up. 

Can I take it from your comments that it will be ok to run it in normal mode? 

Thanks.

Ambucias · Answer

Please, foul language, explicit or not is not tolerated on Kioskea.  Even children, male and female have access to this forum.  Luckily I was able to retrieve your message which was sent to the garbage bin.  Please, let us behave as if we were gentlemen.

Yes, you may run Combofix in normal mode.

confusedcius2 · Answer

Hi again Ambucias,

First of all I apologise for my last post. I am used to posting in forums where it is deemed acceptable so long as you don't type the full word and use punctuation as a filler. Normally, if I register at a forum I think I will be frequeting regularly I am quite diligent in reading the terms and conditions, but when I registered here my mind was a spin about the virus and I was hoping, (somewhat optimistically it now appears), for a quick fix, so I didn't bother. I'd hate you to think that you were wasting your time on someone who didn't appreciate it, so once again sorry.

I've run Combofix as instructed. Here is the link to the log : 
https://authentification.site/files/30636925/ComboFix.txt

Unfortunately I have to report that everything we've tried so far appears to have made things worse.

1) I still get the pop up requesting a user ID and password when I try to activate 
    Windows Live Mail.

2) In addition to the above, I now also get another pop up from Norton which
    says E-Mail Error - unable to access the temporary file folder.

3) I still the message about the driver initialization failure when I attempt to start 
    the computer in safe mode.

Once again, sorry about the last post.

Regards

confusedcius2 · Answer

Hi Ambucias,

I think I've finally managed to sort the problem.

Instead of trying to validate my password through Windows Live Mail I've done it through my ISP's website instead and this seems to have freed everything up.

Although I still have to log into Windows Live Mail, (which I didn't before), it now accepts my username and password and everything seems to work ok.

I think that what probably happened is that one of the procedures you told me to carry out removed the virus, but Windows Live Mail still wouldn't accept my password because I'd tried to change it but couldn't validate the address.

I really appreciate all the time and effort you've spent trying to sort this out for me.

Many thanks.

Ambucias · Answer

You are most welcome, it was my pleasure and shall keep it all to myself :-)

Thanks for taking the time to give your feedback.

Doit2it · Answer

I have been having the same issue for a couple of weeks and I believe I've found the issue.  It has to do with Live Mail's 2 step verification.  I turned it off and the issue was corrected immediately.

Go to www.live.com and sign into the account with issues.
Click the gear in the upper right corner and select 'More mail settings' from the drop down menu.
Under Managing Your Account click 'Account Details'.
Click 'Security Info' from the left menu bar.
Turn off 2 step verification.

This fixed my issue.  Not sure if there is a fix to have 2 step and use the Live Mail program.  I'm just happy I can receive my emails again.

Problem with Windows Live Mail

16 responses

Similar discussions

Subscribe To Our Newsletter!