daleeric
|
posted on July 8, 2002 07:31:41 AM new
Hi all,
I wonder if you have any insight into this. We have mail being returned to us from e-mail addresses that we did not e-mail. This is the only symptom so far and has been going on for about a month. I have never seen these addresses before and have been very careful by never opening attachments ect. No other symptoms to report. Does any know which virus this might be? Or is it a virus?
Thanks!
|
mrhaneys
|
posted on July 8, 2002 07:42:28 AM new
could possibly be the w32.klez virus. i would update your virus definitions and run a thorough scan of your hard drive.
|
lindajean
|
posted on July 8, 2002 08:26:38 AM new
I had the same thing happen to me about 3 months ago. Hundreds of emails each and every day returned to me as "unable to deliver" and as "returned because of Spam heading". I did not send any of them and still do not know what happened.
I ran a virus check usine McAfee, Panda and Norton -- nothing found on my computer and I never had any other problems.
I changed my passwords on all my accounts, Ebay, Paypal, and my mail server and they disappeared. My mail server because I was pretty sure that someone was just "using" my mail account to send out spam, and the others because I was afraid they had actually hacked into my computer.
People still insist I probably had a virus, but it never showed up or did anything else and there is no way these addresses came from my address book. I did understand if someone who had the virus also had an email from me in their computer it could "steal" my email address to continue what it was doing.
But, all my emails were sent out as Spam for an adult casino so I still think the email account was just hacked into somehow.
Anyway, if you change your email password that should stop it soon if it is not a virus.
|
dadofstickboy
|
posted on July 8, 2002 08:39:59 AM new
I had quite a few of those last month.
Each one had the w32.klez virus.
|
Libra63
|
posted on July 8, 2002 09:10:15 AM new
Same with me I have had about 5 in the past week but Norton picked them up. It was mail from porno sites, no I don't frequent any of those and I am the only one on my computer. I don't open any email that I have no idea who it is from. Lately it seem like they are coming out of the woodwork and I wish it would stop. My ISP has something I can put in my mailbox to stop spam but I have to figure out how to attach it. This is getting like the telemarketeers. Obnoxious
|
mlecher
|
posted on July 8, 2002 09:24:43 AM new
Its the new trick of the spammer. Most people do not set their filters to screen out email of "unable to deliver". Most of the time you want that email to see what wasn't delivered and to who. And you read the spam, mission accomplished...
.
Reality is a serious condition brought on by a lack of alcohol in the system
|
sanmar
|
posted on July 8, 2002 10:17:13 AM new
In the past 10 days I have had at least one email from unknown sources per day. Each runs about 120KB Various names on them & the subject has been "Absolute" I opened one feeling it was probably a worm & sure enough, it was a w32.klez worm virus. My Norton picked it up at once & put it in quarantine. I deleted all since then.
[ edited by sanmar on Jul 8, 2002 10:18 AM ]
|
revvassago
|
posted on July 8, 2002 02:51:39 PM new
I had one of those today. Virus scan came back negative.
|
patgmac
|
posted on July 8, 2002 03:08:21 PM new
Get a Mac 
|
dadofstickboy
|
posted on July 8, 2002 03:10:52 PM new
MAC'S never get virus's??
|
dman3
|
posted on July 8, 2002 03:48:20 PM new
last month I recieved a few bounced Email I never sent out as well.
Not spam with a false rejected subject but honest bounces from addresses that didn't exsit.
me thinks there is some new hack program out there able to send email from other email accounts or some such thing we havent seen in the news as of yet.
http://www.Dman-N-Company.com
Email [email protected]
|
revvassago
|
posted on July 8, 2002 03:51:22 PM new
My guess is that it isn't sending it from my account, it is just using my email address as the "From" (or the sender).
I know you can do this from an internet kiosk (a pay-per-minute internet station, commonly found in truckstops)
I would guess there is some sort of email program that allows you to do this as well.
|
patgmac
|
posted on July 8, 2002 04:18:21 PM new
dadofstickboy,
Maybe 1/2% as much as Windows. I've been downloading from 'questionable' sources for years and have yet to get a virus on a Mac. Since 1984, there have been about 500 virus's for Mac, Windows has over 50,000 with more daily. I can't remember the last time we got a new virus lol 
|
gravid
|
posted on July 8, 2002 04:38:54 PM new
Someone has probably spoofed your address to send out spam.. When they do that they usually put an 800 number or some other way to harvest the suckers and all you get are the remove and death threats.
|
sn0bbish
|
posted on July 8, 2002 04:46:53 PM new
maybe thats because more people use pcs then macs. thats why there is a higer ratio of pc viruses to mac viruses.
|
patgmac
|
posted on July 8, 2002 04:58:05 PM new
No arguement there.
|
birgittaw
|
posted on July 8, 2002 05:58:06 PM new
Had the very same thing happen ... all emails to addresses within my domain, with a couple of returns from postmaster with invalid addresses. This is what my abuse tech wrote in response:
"What you are experiencing is because the spammer, who is in Asia, forged your email address on his spam. It is a common tactic these days as spammers attempt to force their junk past spam prevention measures.
There is little that can be done to stop it since the spam is coming from Asia. As the spammer moves on to attack other domains he should stop using your address as his forged "From:" address and you should get no more delivery failure notifications."
This happened to be a mortgage options spam with a happy Korean smiling in the one email I got from me to me. And the spams have only reached the "c" part of the alphabet in generating addresses.
Regards,
Birgitta
|
caffeitalia
|
posted on July 8, 2002 06:48:18 PM new
A SPAMMER HAS STOLEN YOUR E-MAIL ADDRESS. I HAVE HAD THIS HAPPEN TO ME TWICE BEFORE A LITTLE OVER A YEAR BACK. HOPEFULLY IT ISN'T THE SAME ONE YOU USE FOR CONTACTING EBAY WINNERS. IF SO, EXPECT MANY TO NOT GET YOUR E-MAILS. YOU WILL WANT TO CONSIDER GETTING A NEW E-MAIL ADDRESS AND USE IT FOR ALL PEOPLE THAT DO NOT RESPOND TO YOUR WINNING BIDDER NOTICES.
GOOD LUCK.
|
bananaspider
|
posted on July 8, 2002 09:50:09 PM new
Hey folks, you do not need a password to do this. I have a program called Spam Bounce. I downloaded it from Tucows. It is designed to send fake bounces to SPAMMERS. All I have do is enter the Spammers email address, my email address, my SMTP and some text. It then sends a bounce message to the Spammers email address tricking them into thinking my email address is invalid. Think about it. This kind of program could just as easily be used to send SPAM.
|
celindra
|
posted on July 10, 2002 03:23:13 PM new
It's definitely the klez worm.
Your computer is not infected. Someone else's infected computer is sending these fake messages.
Just don't open the attachment.
|
caffeitalia
|
posted on July 10, 2002 09:23:21 PM new
celindra,
You are misinformed about the KLEZ. If you open an e-mail with KLEZ, you can catch it. It is different from many other viruses in which they hide in the attachment. KLEZ hides in the main body of the e-mail and releases when the e-mail is opened. It is no question that a spammer has stolen the e-mail address.
|
celindra
|
posted on July 10, 2002 09:58:29 PM new
Klez doesn't automatically open when you read the message. That only happens if you have your e-mail program set to open them.
Usually, the attachment is an .exe or .scr file.
I should know, I get a dozen of the e-mails a day.
-----
Back to the original point:
This is not a spammer. It is a classic symptom of the klez virus. If you are receiving "bounced mail" that you did not send, klex is to blame.
Symantec's klez page:
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]
[ edited by celindra on Jul 10, 2002 10:00 PM ]
|
celindra
|
posted on July 10, 2002 10:03:12 PM new
Furthermore:
Here is the info on fake bounced e-mail, direct from Symantec:
"This worm often uses a technique known as "spoofing." When it performs its email routine. it can use a randomly chosen address that it finds on an infected computer as the "From:" address, numerous cases have been reported in which users of uninfected computers received complaints that they sent an infected message to someone else.
For example, Linda Anderson is using a computer that is infected with W32.Klez.H@mm. Linda is not using a antivirus program or does not have current virus definitions. When W32.Klez.H@mm performs its emailing routine, it finds the email address of Harold Logan. It inserts Harold's email address into the "From:" portion of an infected message that it then sends to Janet Bishop. Janet then contacts Harold and complains that he sent her an infected message, but when Harold scans his computer, Norton AntiVirus does not find anything--as would be expected--because his computer is not infected.
If you are using a current version of Norton AntiVirus and have the most recent virus definitions, and a full system scan with Norton AntiVirus set to scan all files does not find anything, you can be confident that your computer is not infected with this worm.
There have been several reports that, in some cases, if you receive a message that the virus has sent using its own SMTP engine, the message appears to be a "postmaster bounce message" from your own domain. For example, if your email address is [email protected], you could receive a message that appears to be from [email protected], indicating that you attempted to send email and the attempt failed. If this is the false message that is sent by the virus, the attachment includes the virus itself. Of course, such attachments should not be opened."
|
revvassago
|
posted on July 12, 2002 03:58:50 PM new
celindra
These emails do not contain any virus - even if you click on the attatchment. They are usually advertisements for porn sites. This is not the klez virus.
|
