Community Newsletter: Q&A forum: 7/29/04 Help! I didn't send them that virus

Answer:

Hello, while I cannot completely help answer the question completely I can give you a very good start to solving your problem. First things first. As you should have heard by now, you really need to invest in some form of virus scanning software. This alone can save a lot of trouble. I also would recommend a separate program to search for spyware (adware), so that you cover your entire basis. Next, here are a few solutions to help with your problem. First, if your using hotmail, or an e-mail program that has differing levels of security, I suggest you beef yours up. This will help you keep unwanted mail out of your inbox, and will help reduce your risk of viruses in the process. However if you do not have the option, and you dont like the idea of buying a virus-scanning program I have 2 quick fix options for you.

First and foremost.. never open any e-mail from any sender which you do not recognize. Also, never open up e-mails with large attachment sizes.. (anything over 10k is a no-no unless it's from someone you know). This right here will help you from being infected. Next, to prevent others from receiving viruses you already may have, I have the perfect solution.

E-mail viruses are usually worms that go straight into your address book and like to send themselves out to everyone you have listed. But there is a quick trick to stop them from ever leaving. Open up a new address book entry and name it something like AAAAAAAAAAAAAAAAAAAAAAAAAAAAA@xcvxcz.com (it's important to use all a's and many of them.) By doing this you should have created a new first entry in your address book. (if not make sure you make it is the first entry.) This is now your measure of protection against others. By doing this you've created an entirely fictitious address. The result is that when the virus goes to send itself out to the first person.. (your bogus entry) the e-mail will not be received and the failed to send message will be the result.

So how does this protect everyone else? Simple.. when viruses send themselves out to others, they place the first entry on your address book at the top, and then add the rest of the names afterwards. Because the first recipient cannot receive the message, the rest will never receive it either. The virus in response will be stuck forever trying to send to the first person on your list, and everyone else will forever be safe. I've used this technique for over 4 years now, and have been virus free since. Hope this helps you out!

Submitted by: Aaron P.

Most everyone has more than one email address. Here's how I make sure I'm not spreading bad medicine. I create a contact in the address book on all my computers with a first name of "Virusalertfrom" and a last name for the specific machine where the contact is stored. I set the contact up to email another one of my email accounts. So, the contact name would look like "Virusalertfrom Dellthree" and go to one of my email accounts. If my accounts start emailing each other, I know there's a problem. You could use a yahoo or hotmail address as the recipient if you liked. Just make it an address you check frequently.

While no substitute for a comprehensive security routine, it is a last line of detection. Unfortunately by the time you get the email it is too late and something akin to closing the gate after all your cows have grazed their way into your neighbors corn field.

The AAAAAAAAAAAAAAAA@ email/worm alert system will not work, except to give you a bounced mail. I get so many bounces I ignore most of them.

PART TWO.
HOW TO GET PEOPLE TO STOP USING YOUR EMAIL ADDRESS TO SEND SPAM/VIRUSES & OTHER NASTY STUFF.
OK, in the BOUNCED virus email, there is usually header info including the sender's IP. You can go to http://ww1.arin.net/whois/ and enter this number. It looks like 66.666.66.24 or similar format. Just enter the originator's IP number into that search field and click SUBMIT QUERRY. You'll find out the name of the ISP hosting that IP address and the hosts ABUSE email address listed down the page. COPY that abuse address, then forward the VIRUS NOTICE to the ABUSE address for the sender's ISP and see if you can get them to contact the IP owner to get them to turn their machine off until they can clean it.

Don't get nasty with the ABUSE people. You need them to help you. What you want them to do is to contact the owner of the IP and advise them of the issue so they can resolve it. Niceness goes a long way with abuse resolution handlers. Some do nothing, but many actually do follow through.

PART THREE
Remember, there are two kinds of computers. FIRST, there are computers with antivirus software, firewalls, Spyware and Adware prevention administrated by people who protect it properly. And SECOND there are the computers that get viruses and other garbage.

Good luck!

The virus that is probably doing the damage is the MyDoom virus (some information of a variant at http://securityresponse.symantec.com/avcenter/venc/data/w32.mydoom.n@mm.html).

MyDoom harvests email from the infected machine from any number of sources including the address book, outlook, outlook express, and web pages sitting saved or cached. Since MyDoom comes with its own SMTP engine, it does not necessarily originate from your computer, or your ISP.

This means that any email you may have sent to someone; anyone who has your email address in an address book; if you have your email address on a web page, anyone who has visited your site; if they have an infected machine, they could be sending these virus e-mails out with your email address as the sender.

I'm experiencing the same thing that Aaron P. has. I have had continual protection by McAfee for several years; my ISP scans my inbox before I download any messages; my address book has been protected; I go through "purification and cleansing" on a regular basis; but I still get "administrator" messages that emails I've sent were infected. In every case the person receiving the corrupted message was not in my address book (or it was not a legitimate or valid address); the message, of course, did not originate from my pc; my address, as the sender, is usually not complete or is an approximation of my real address. In short, I, or my pc, was not responsible for the virus event, but my address was affixed somehow and I've become the victim.
My feeling is that virus-corrupted email is being spawned by third parties who have assumed innocent email addresses as the senders. I gave up long ago trying to placate all the recipients and ISP's who felt I was guilty: MEA NON CULPA!
And if Aaron (and myself) has been responsible and adequately protected himself and his address book, then your answer and advice are just thrown to the wind. I can't find blame in Microsoft or any of its products other than that they allow open and free discourse over an internet that most of us want and find convenient.
Perhaps the fault lies within the ISP's who have the ability to verify IP addresses with associated ISP's and email identities: maybe we all need our permanently assigned IP address combined with a legitimate ISP email handler.

Like you I had all these things, and lots more occuring at regular intervals.
I purchased all the best virus busters / firewalls and popup stoppers with very marginal success, every day I faced new threats, and even though I spent a fortune on these products I never really felt safe, and I always kept asking myself why do I have to pay for what these virus writer idiots are doing.
Well it turns out I don't one simple change and about $100 has changed that forever, I dont need popup stoppers or virus scanners and I am totally confident that my system will never send an email to anyone without my personally pressing the send button.
The answer don't patch up the 'patchwork quilt' with expensive virus and popup stopping software, simply change the operating system, there is a very viable alternative, just look for it.

At least 20 new virus related ms attack software items are produced every day, (Quoted by panda Software I believe they would be in a position to know).
Even with a fully paid continuous update virus / firewall system, several of the nesky virus systems have been able to sneak into my system before the update was in place.
Even being on the net trying to get one of the several microsoft critical patches I was zapped. The list of problems continues. The short and long of it is that my entire system was destroyed on at least 3 seperate occasions. On the last occasion the system would fire up (and this was with the firewall/ scanner in place) and was so busy that it was impossible to get the mouse into the task-bar area let alone make it activate the start button.
Look it may appear that I am knocking microsoft this is not the case, microsoft have a lot of great products, but be dammed if I will ever let any of them near the internet.
Where as with xandros I leave the system on line 24/7 and it all just works every time, I can run most microsoft products if I wish, I dont have to waste all my time and resources fixing computer problems, what's more it is simple to install (4 click) and knows about virtually all the surrounding hardware.
The Firestarter firewall is free, and I have not had a single glitch in the past 4 months. You choose.

I repeat I no longer have those problems, and personally I would never again allow an ms operating system near the web, why should the general public be made to pay to protect a faulty operating system.

You obviously haven't seen xandros

I know nothing about mac but
Good luck to them trying, on linux most of them would be dead and buried before they had time to break through the linux security let alone the free firewall (no I didn't have to pay for the firewall unlike anything to protect ms stuff) if you had a real look you would realize that the task of writing a vurus for windows against linux compares to 'strolling down the shop for some lollies' or
buliding an f1-11 fighter' anyhow stay with your problems if you like them so much.
I really love xandros (i can sleep at night now)

The solution regarding using a bogus email address with many As, I don't believe is true. This advice has been circulated on the Internet for many years now, and if you check the urban legends website http://www.snopes.com/computer/virus/quickfix.htm it suggests that this claim is false.

I'm a little surprised that CNET let this advice be posted. There is a lot of misinformation being circulated online and we should all check out the authenticity of the information we are passing along to others.

Ok let's not go pointing fingers. As a support person myself, and having worked several areas of support you must understand that this is an "Open Fourm". Thus everyones ideas are open for posting and discussion.
As to this paticular disscusion. The best advice is (as stated in another responce) "PC Care".
Make sure your system is up to date, doesn't matter weather it is Windows, Mac, Linux, or Sun. Make sure your virus software is up to date. Get an adware scanner/blocker, a personal firewall helps, keeping in contact with your ISP really helps.
As for the bogus first address in your contacts list, this is an urban ledgand, alot of viruses don't care what the first addi is, it will still send to all of your address's.
The figerprint that was mentioned in another responce can be changed, just ask your ISP. No cost, minor headache, and they will walk you through making any changes to your system that may be needed. If they don't or won't, then they are a security risk themselfs.
Due to this happening to me 18 months ago, I have set up a rutine to contact my ISP, and make these changes on a regular basis. Security is a growing need and we all need to beaware of differant kinds of threats. Than protect ourselfs from them.

I have to say i agree with nanimp, in a sense. Although you are totally right that postings shouldn't be censored ...


... this forum lends more credibility to the answers by implying they are the "best answers chosen from all submitted". IE, this being selected as one of what, five top answers, implys some folks at CNet.com read it and agreed with it -- some presumably knowledgeable tech folks. I would hope that a completely bogus answer like this one would indeed be not accepted (although it did indeed bring up some interesting points about possibly using your address book as a virus-early-warning device ^^)

I've run into this problem before. The ISP that we were trying to send emails to used reverse DNS to make sure that the originating SMTP server's IP address matched the domain name of the recipient's address.

If you're sending emails out using a local SMTP or your ISP's SMTP server, you're technically relaying this email and the source does not match the address.

To check what SMTP server these ISP's are expecting, look up your domain name using nslookup (web based tool at http://www.zoneedit.com/lookup.html). The records in question are the MX records. If you're not using the SMTP servers that are in these MX records, you need to find out how.

If this doesn't help, then your problem is different than mine and a disregard for this post is in order.

Hi,

I had this very same thing happen to me. Here's what I did:

Firstly, I use Eudora e-mail software, so it was easy to find out which server was sending the spam (using the Blah, Blah, Blah feature). Then I went to whois.com and looked up who they were. You will likely get false information from them, if any information at all. However, try Joker.com. In my case, Joker was their registrar, therefore, I contacted them with all headers and they put a screeching halt to the spammer.

BE PREPARED: these spammers will use your e-mail address on several businesses. In my case, they provided a link to their pharmaseutical company right on the spam they sent. It took a couple of days to get it sorted out. Just remember, be vigilant with contacting their registrars, they will stop them.

Good luck!!!!
Angela

I can asure you that after you wrote this trick here, it's not going to work for you anymore.
This kind of trikcs you should't write in a message board.

is there a way to make sure? I received some Returned Mail; Service Unavailable from the aol postmaster in my Yahoo mailbox (to messages I didn't send). The message is 554-Unrepairable virus detected. They seem to be due to the W32/MYTOB-CL worm (subject is either Good day or mail transaction failed). I run Windows 98 on a pc and run Norton and Ad-aware scans (they didn't find anything) and have Zone Alarm. Should I run something else to be certain? Thanks!