localhost - email problem

[Dragonette]

Can any help with this

My accounts in my email program (Outlook Express and MS Outlook 2000) continually change to local host for my incoming POP3 server

I thought it was IExplore 6, but I went back to 5.5 and it still does it

I was told Nortons will do that, but I don't use Nortons!

It is really annoying!

Anyone else got this problem?

 

[BlkPnthr]

While I don't have the problem myself, it is a common occurance. What kind of internet connection do you have? Dialup, broadband? If you manually change your POP3 addresses for incoming and outgoing and it switches on you, I'd be looking for a virus.

 

[Dragonette]

Yup

I dial up using a modem

It was fine, until I did something

AS I said, I thought it was Explorer 6, but not as it still happens in Explorer 5.5

I might have to go back to Explorer 5
I set up a friends PC and she gets the same thing, and she only has the one account!

I haven't had time to check the Microsoft service packs to see if there is a cure there.

 

[BlkPnthr]

Interesting. I am not extremely familiar with email troubleshooting, but if you like I can get you some information on fixes for this. I have a fair amount of computer techie connections. Just let me know and I'll dig up some answers for you.

 

[Dragonette]

That would be great

All my techy friends are stumped
Even my ISP doesn't know!

I am not entirely clueless, I work in IT, but I can't remember what I installed before this started, must be something like that!

 

[Dragonette]

That would be great

All my techy friends are stumped
Even my ISP doesn't know!

I am not entirely clueless, I work in IT, but I can't remember what I installed before this started, must be something like that!

Any help is always appreciated

I can get my emails eetc, but it is so annoying having to change them all every time I log in!

 

[BlkPnthr]

What windows version are you running?

 

[Dragonette]

win 98

It's not that though

 

[BlkPnthr]

A friend of mine directed me here.

I'll post the information because I wouldn't want you to go to the link or not go to the link for that matter thinking I may be attempting to give you a virus.

OL2000: E-mail Account Settings Are Changed (Q303645)

--------------------------------------------------------------------------------
The information in this article applies to:


Microsoft Outlook 2000
Microsoft Outlook Express versions 5.5 , 6.0 , for Windows 2000
Microsoft Outlook Express versions 4.0 , 5 , 6.0 , for Windows NT 4.0
Microsoft Outlook Express versions 5 , 6.0 , for Windows 98
Microsoft Outlook Express versions 4.0 , 5 , for Windows 95


--------------------------------------------------------------------------------


SYMPTOMS
When you use Outlook 2000 or Outlook Express to check mail, the settings may be changed to "Localhost" in the Post Office Protocol (POP) server settings and "account name/pop server name" in the Account Name box on the Server tab.



CAUSE
This issue can occur if you are using Trend PC-cillin antivirus software.



WORKAROUND
To work around this issue, disable the POP3 Scan feature of the Trend PC-cillin software:

In the status area of the taskbar, double-click the PC-cillin icon.


Click to clear the Enable POP3 Scan check box.


Reconfigure your POP3 e-mail account in Outlook with the correct settings.





MORE INFORMATION
POP3 Scan is a feature of Trend PC-cillin that scans all incoming mail for viruses. Some Internet service providers require configurations that are not compatible with this method of virus scanning.

For additional information about reconfiguring your Internet e-mail account, click the article numbers below to view the articles in the Microsoft Knowledge Base:

Q195578 OL2000: (IMO) How to Set Up Internet Mail Accounts
Q195795 OL2000: (CW) Troubleshooting Outlook Configuration Problems
The third-party products discussed in this article are manufactured by vendors independent of Microsoft; we make no warranty, implied or otherwise, regarding these products' performance or reliability.

I hope this helps you. If not, please let me know and I'll dig deeper.

 

[Dragonette]

I found it

It is the anti virus program....
But I can't turn it off as I have received 5 of a new one and my anti virus caught them all

The worm
WORM_MYLIFE.A
It comes out as goobleygook


There have been a few reports of this occurring with IE 5. The most likely cause is said to be from anti-virus programs checking your e-mail as it comes in. This has been reported as changing server settings to "localhost". What happens is that the anti-virus software must first capture all your mail in a temp folder where it can be checked before it's loaded into the email program. This can result in time-outs and so the pop server is set to local or localhost - which is just your own PC.
Try disabling the email scanning and reset your POP3 and SMTP servers to the original settings. You should still be protected if you have the AutoProtect feature enabled.


The solution in my case was as simple as turning off the "POP3 scan" facility of my virus scanner (Trend PCcillin 2000). Apparently the scanner shunts incoming e-mails to a temporary folder, scans, then brings them out again,. The system must then think that emails have come from "local host" and alters settings accordingly --"local host" in this case is your own PC.

 

[Dragonette]

The virus is...

WORM_KLEZ.E

Go to
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=WORM_KLEZ.E
for the fix


Risk rating:
Virus type: Worm
Destructive: Yes

Aliases:
W32.Klez.E@mm, KLEZ

Description:
This destructive mass-mailing worm propagates copies of itself across network drives. Upon execution, it drops two executable files, WINK*.EXE and WQK.EXE, in the Windows System folder. It also creates registry entries that allow it to run at system startup.

This worm terminates processes, and occasionally deletes files associated with certain antivirus programs.

Special Note for March 6, 2002:
On the sixth (6) day of every odd-numbered month (January, March, May, July, September, November) it overwrites files with the following extensions:

TXT
HTM
HTML
WAB
DOC
XLS
CPP
C
PAS
MPEG
MPG
BAK
MP3
JPG

Solution:
Automatic Removal


Download and apply the fix tool, fix_klez.com.
Trend Micro recommends that all users read the readme_klez.txt before using this tool.
Scan your system with Trend Micro antivirus and delete all files detected as WORM_KLEZ.E. To do this, Trend Micro customers must download the latest pattern file and scan their system. Other email users may use HouseCall, Trend Micro's free online virus scanner.
Manual Removal


Scan your system with Trend antivirus and note any infected file named WINK*.EXE (* is a random number of random characters)and Delete all files detected as WORM_KLEZ.E. To do this Trend customers must download the latest pattern file and scan their system. Other email users may use Housecall, Trend Micro's free online virus scanner.
Click Start>Run, type regedit then hit Enter.
Double click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows
>CurrentVersion>Run
In the right panel, look for this registry entry and delete it:
Wink*, "wink*.exe"
Using your notes in step 1, delete all values in the right panel that have the same name as those files detected/deleted by your Trend Micro antivirus.
This worm makes use of a vulnerability in HTTP-based email clients like Microsoft Outlook and Outlook Express. Please apply the latest patch:
Update to Internet Explorer 5.01 SP2
Update to IE 5.5 SP2
Update to IE 6.0
Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network or home PC.