I am running Incredimail on Windows XP. The address of my Pop3
incoming mail server has been hijacked and replaced with 127.0.0.1.
Who or what is this? After deleting these numbers and retyping the
mail server, the program works fine. But when I shut down and then
restart [ next day] 127 is back. Help please. With plenty of detail.

---

Clarification of Question by pugwashjw65-ga on 09 Apr 2006 17:39 PDT

I alrady have Webroot SpySweeper , McAfee Antivirus and Antispam. Paid
for systems. They have done nothing. Any more suggestions please.

127.0.0.1 represents your own machine. It is attempting to connect to
your own machine for some reason. Could be a trojan, could be that the
software can't connect on boot up, and is replacing the pop3 value
with the local host IP. Try running Spybot - Search and Destroy (or
just a decent AV prog) to start with.

Good luck.

You might want to use this software to clean your computer.

http://www.download.com/HijackThis/3000-8022_4-10227353.html

After using this, you can use Search &
Destroy(http://www.spybot.info/) and
Adware(http://www.lavasoft.de/software/adaware/)

By using this three software, you should be able to clean your
computer. What other software are you using also?