Am I sending out viruses or not...?

Jim Cohen · From: Philadelphia, PA

For the past week or so, every day, I've been getting messages from the infamous "Mailer Daemon" saying that some email I allegedly sent out was rejected due to containing a virus. But I never sent the message, don't even recognize the email address of the recipient, and my Norton Virus Protection system says I have no viruses. So... I figure somebody else's computer got a hold of my email address and has been sending out viruses under my name. Oddly, though, my listing of "Sent Mail" does not show any suspicous listings of mail that I supposedly sent. So... I don't really know if I've been sending out viruses or not! But I think I have not. Comments?
Thx,
jc

Jim Smith · From: Midlothian, TX, USA

No you haven't been sending them. I get the same thing and I'm sure many others do too.

I was wondering why I never get these virus emails myself until I had to check my email online one day to delete one with a malformed header. My Comcast email was almost full with "Screened Mail". Apparently they are screening out the virus for me.

Jon Light · From: Saugerties, NY

comment: I've been in exactly the same place. Nothing in the sent folder to indicate any activity. It is my understanding that although there are worms or viruses that can use your program to send stuff, in this case it's just identity theft---someone else is sending stuff out using your return address. Anything that is undeliverable will come back to you, therefore, rather than the true source of the mailing.
What I can't understand-----this scenario would imply that a whole bunch of people should have indeed received a mailing, ostensibly from me---why doesn't anybody write to me asking why the f%@#k I'm sending them crap? This is the missing piece to the otherwise logical explanation. I've done nothing but delete them when I've received these mailer daemon returns and nothing bad has followed.

Donna Dodd · From: Acworth, Georgia, USA

Here's one we can't figure out:

I get all outbound ebay mail belonging to my cousin (who breeds horses) whenever she REPLIES to a bidder!! Even if she sends a test message to herself - I get it. It's been going on for so long that I automatically send them back to her signed "email Bandit". I'm even deleted from her address book. Figure THAT ONE out!

Karlis Abolins · From: (near) Seattle, WA, USA

This is very likely a result of the Sobig virus which became active a couple of weeks ago. The Sobig virus uses its own mail engine to send infected e-mail to any recipients that the e-mail program has in its address book and address cache (when you receive an e-mail, the program stores the sender's addresses). The Sobig virus has a subtle twist. When it sends out mail, it spoofs the return address by choosing one of the addresses in the cache. So...if someone who you have ever e-mailed has the Sobig virus, the Sobig virus on their machine will probably use your e-mail address as the sender.
When the ISP's receive the infected e-mail, their virus filters detect the virus and send out a message to the sender that the message was undeliverable because of a virus. The unfortunate part is that the mailer daemon e-mail comes to you even though you did not send it.
It is important to protect your computer with a good anti-virus program and a good firewall.

(I have been repeating this spiel for a couple of weeks now in my other life as LAN administrator. I always run a virus scan on the person's computer to make sure that the computer is not infected. Of all the computers that have reported this problem, none has been infected. We try to practise safe computing but you can never tell what people will do.)

Karlis

[This message was edited by Karlis Abolins on 07 September 2003 at 05:28 PM.]

Chip Fossa · From: Monson, MA, USA (deceased)

Karlis,
I'm presently running for anti-virus, AVG. Seems OK, so far. Has caught a few viruses. I also am
running Ad-aware 6.0. I also have KILLAD, which I haven't found a need to use as of late.

Hardly any popups.

Do you think I still need some kind of Firewall?
When ATTBroadband was my server (now COMCAST)
I had SYGATE running; but no longer.

I've been really busy lately with work and my band, and so my ONLINE time has diminished
appreciably.

Thanks for any advice.

Chipper

[This message was edited by CHIP FOSSA on 08 September 2003 at 06:35 PM.]

Karlis Abolins · From: (near) Seattle, WA, USA

Chip, Put your Sygate firewall back up. Some of the newer viruses don't infect by e-mail. They use Windows vulnerabilities to make your computer do what they want to do via the internet. Windows has a lot of published and unpublished techniques for letting computers interact with each other. These newer viruses use the techniques for malicious purposes. When the computer is on and connected to the internet (in your case this is whenever the computer is on because of the cable modem connection), other computers can and do probe your PC for these vulnerabilities. Firewalls prevent these probing computers from getting through to your Windows operating system.

Karlis

Bob Kononiuk · From: Springfield, Missouri, USA

Jim I was having the same problem but my ISP sent me this to fix it and it worked. Only takes about 15 minutes. Follow the directions carefully
http://www.mchsi.com/help/Sobig.F

------------------
Bob Kononiuk
______________
Carter SD-10
Nashville 112

Chip Fossa · From: Monson, MA, USA (deceased)

Thanks Karlis. I'll heed your advice and re-install Sygate Firewall.

Regards,

Chipper

Forum Index > Computers		Next oldest topic :: Next newest topic

All times are GMT - 8 Hours	Jump to: