virus?!

Daz · Jun 2005

Urgh, this cant be so. How the hell do I pick this crap up?

So, my e-mail is acting very oddly. Basically, almost every day in my comcast account, I get several messages that *appear* to be returned mail. i.e mail that bounces back to me that didn't make it to it's destination. And yet I never sent any mail and they're always addresses that I don't recognise.
Subject headings such as 'Returned mail: Service unavailable' from 'Mail Delivery Subsystem [MAILER-DAEMON@aol.com]' or 'Undelivered Mail : Unknown user' is the kind of crap Im getting.
I'm not opening them of course, but even without ever having done that, this seems weird.

Norton AV isn't picking anything up. If this weirdness looks familiar to anyone I'd be curious to find out what it is.

thanks.

Weiser_Cain · Jun 2005

Sounds like it's spoofed adresses just report them as spam. do not open them there are ways other than viruses to screw you compy.

Joshua Stubbles · Jun 2005

I've never had issues with virus' like that, but I seem to be plagued with PC issues @ work. Either our PC's are pure crap inside, or I have work voodoo of some kind. After 1-2 hours of using max+photoshop, the whole machine starts to die. I can work 10+ hours at home, and not have any issues at all. Meh.

Rick Stirling · Jun 2005

Daz, my parents got it a while ago, and they were getting a several thousand emails a day.

It took me a day to get rid of it, running every visus checker and spyware program I could find. I can't tell you how it eventually went, but I know I used

Spybot
Adaware
MS Anti Spyware
AVG Virus
Sophos free download thing

It went, but that was after running each several times.

oXYnary · Jun 2005

Yea, lots of emails like that recently. Things like supposedly bounced back messages. The thing my AntiVirus (CA eTrust EZ AntiVirus) does detect them, and is automatically fixing them before they reach my inbox. Im using the Firebird email client.

KDR_11k · Jun 2005

Perhaps a spammer or virus that knows your address is spoofing mail from you. Few viri nowadays don't spoof the sender address and it could very well be that a friend of yours managed to get infected, the virus got your email addy from his files and pretended to come from you.

Weiser_Cain · Jun 2005

I could swear I said as much...

KDR_11k · Jun 2005

You just said "spoofed address" which doesn't say who or what is spoofing. Could be that you meant a virus posing as a mail delivery failure, could be that you meant a virus posing as Daz, could be that you mean a spammer posing as him.

MoP · Jun 2005

I think KDR's on the money here. I've been getting a few of these recently, fortunately not that many though. I've got constant updated antivirus and firewall, and I've run a number of different scanners and Ad-Aware - my computer is clean. I guess it's just spoofed stuff. A few months ago it wasn't unusual to get 200+ spam emails a day... fortunately that's stopped now... gah, technology

Rick Stirling · Jun 2005

On my parents PC it was a trojan that was using their email address, but not their email software to send marketing emails. When they switched on their email software they then recieved the bounced ones - several thousand per day.

If its just one or two messages, tis probably not that, but when it gets so that you are receiving an email a second....you've got a problem.

bearkub · Jun 2005

There is actually a viral email that used the "returned mail" subject at one point, I have forgotten the name.

Basically DaZ, if you are getting like 5-8 of these a day, it probably isn't anything related to your machine being infected, it's probably just more junk. If you ran your A/V software and the malware cocktail that Rick recommended you should be OK.

But yah, as said above, if you are getting 10-20 an hour or something....yah, you might have gotten whacked.

drakino · Jun 2005

Is your e-mail address posted anywhere on the web that has frequent visitors? If so, that is probably why, and let me explain.

A few of the viruses/worms writers out there decided that just relying on someones address book wasn't good enough to find e-mail addresses. These viruses use e-mail addresses for two purposes, as an address to try and infect, and also an address to spoof the e-mail from. The spoofing helps to slow down the "Hey Joe, I got a virus from your e-mail, run your scanner" type responses to get rid of them.

Anyhow, these newer ones now scan through the web browser cache for any e-mail addresses it can find. Thus, if a person who say in theory visited your home page got infected, the virus would find your e-mail address in the internet explorer cache and start using it to spoof from and as a target.

The fix to this is to obscure or change the e-mail address you post to any web site or web board. Once their cache gets emptied, it should die out.

I get quite a few of these bounces when a new version of some e-mail virus comes out, due to a web board I administer elsewhere. The viruses catch the admin e-mail link at the bottom of the page and use it quite a bit. To counter this, I just filter out the returned mail messages to that address, and also change it about every 2-3 months. It sucks to have to do so, but it avoids unnecessary traffic on the mail servers. Sadly these days most mailservers see a higher percentage of viruses and spam messages then they do legitimate e-mail.

virus?!

Replies