[SOLVED] Yahoo Auto-compose

[indy-pc]

This is a new one for me:
Client uses Yahoo email. When he logs into the website on his laptop, it will pop up with a new draft email (subject line is something about Holiday Inn wireless) every time. On this system, it occurs in both Chrome and IE, but there it doesn't happen on any other system. It also happens in normal and safe mode.

I'm thinking that this has to be a virus of some sort, right?

All of my scans are coming back clean, though: MBAM, SAS, AdwCleaner, Hitman Pro, Avast, and MBAM anti-rootkit. This is a remote session and I ran Combofix, but I can't confirm if it ran properly. I'm running one last scan (VipreRescure), but I don't expect this to solve it either.

Any ideas or suggestions?

 

[nlinecomputers]

Clear cookies and history files. Bet there is some cookie on this doing that.

 

[indy-pc]

Clear cookies and history files. Bet there is some cookie on this doing that.

I forgot to mention that I did try that in Chrome. I cleared everything back to "beginning of time" and it's still doing it.

 

[nlinecomputers]

Yahoo mail has a drafts folder. Is it empty?

 

[indy-pc]

Yes. It creates a new one every time I login, so I empty the folder each time. If I don't empty it, it just keeps adding a new one.

 

[nlinecomputers]

This may be a clue: https://support.mozilla.org/en-US/questions/963948

Default email program in Programs and defaults maybe goofed up. Set to a webpage instead of a program like Outlook or Thunderbird.

 

[indy-pc]

I figured it out and I feel really silly about it.

For some reason, he saved his favorite link when he was composing that message. I didn't notice that there was something like "compose=subject:Holiday..." at the end so whenever I clicked on the link it was doing exactly what it was supposed to do. I just edited the favorite properties to just be the login page and he's all set now.

Thanks for the tips and suggestions!

 

[nlinecomputers]

Ah so he phished himself. LOL. Glad you figured it out.

 

[Xander]

I figured it out and I feel really silly about it.

For some reason, he saved his favorite link when he was composing that message.

If I'd seen this thread earlier, I might have saved you some grief. Had a few customers do things like this over the years and it was the first thing I thought of.