Printable View
Hi Ppl
I dunno wehther this is a new virus or not, but it seems that some virus or worm is sending mails to ppl in my Outlook Contacts automatically.
Plz tell how can I tell which virus it is , and how to get rid of it. And how on earth did it land into my system ?
First off if you have an anti-virus program you should up-date it. Then once you have done that do a full system scan.
If you do not have an anti-virus program then give this on-line scan a try : HouseCall
If you do not own an anti-virus program then well give this one a try :
AVG Free Edition
Well as for how the virus might have got there. Give this a read :
How viruses spread
It might now answer how exactly it got on your computer but it will just give you an insight as to how viruses spread.
Hope that helps ....
I have an anit -virus programme up and running "InoculateIT", it didnt detect anything.
Besides my comp is behind a corporate firewall, I think even that should help keep away viruses.
But at present I would like to know, how can a virus be traced on my comp. .. .which process it is running, which file is it located in ?
A firewall will not stop a virus from infecting your computer, as it usually comes in an attachment that you have opened. Some virus are capable of disabling your present antivirus protection and even your firewall.Quote:
Originally posted here by Desolation_Jam
Besides my comp is behind a corporate firewall, I think even that should help keep away viruses.
I would suggest that you follow Agent_Steal's advice and make use of a third party virus engine to check your computer. Or in the very least, down load the current updates to your antivirus and then boot into the safe mode and run the antivirus. (it would be better if you could download a new and updated virus engine on a noninfected machine, and load that in safe mode also.
Once you have the virus identified, it is alot easier to deal with. And if it a case where your machine is not infected and your e-mail is being spoofed, then you will have varifieable results to prove it.
Hi moxnix
I think there is no virus in my comp, as advised I have downloaded all new update and scanned my comp for viruses . . . . no malacios files were found, as you said how can I get to know whether my mail is being spoofed or not ?
Desolation_Jam you got me a little confused here ?? Cause from reading you wanted to know which virus it is ??Quote:
Hi Ppl
I dunno wehther this is a new virus or not, but it seems that some virus or worm is sending mails to ppl in my Outlook Contacts automatically.
Plz tell how can I tell which virus it is , and how to get rid of it. And how on earth did it land into my system ?
But then you scanned your computer so theirs no virus ? Then you ask how you can trace it by asking:Quote:
I have an anit -virus programme up and running "InoculateIT", it didnt detect anything.
Besides my comp is behind a corporate firewall, I think even that should help keep away viruses.
But at present I would like to know, how can a virus be traced on my comp. .. .which process it is running, which file is it located in ?
Ok so exactly what is it that you need to know ? Cause you got me a little lost.Quote:
which process it is running, which file is it located in ?
Is this the question that you want an answer to ??
Question
Why is Outlook sending mail to people who you know ?
First you must determine if the people receiving these e-mails are in fact contacts from your address book. If they are not, then it is a good sign that yes, you address is being spoofed.
If they are contacts that you have in your address book then you have more of a problem. Either someone has copied your address book, or they have the means to gain entry into it.
The main ways they could have gained this entry is
1) physical access to your computer
2) some form of virus or trojan on your computer
3) a keylogger (either physical or virtual) on your computer to steal your passwords
4) poor passwords and/or poor password security (as in a sticky note on monitor)
If in fact they are contacts from your address book, I would first export(copy) the address book into a different file and then delete the current one in your outlook express. Then for a few days, when sending e-mail, do a copy and paste from the new file. This should stop most means from using your addresses to send out anymore e-mails from your machine.
I would also set your options to make copies of any mail sent from your account.
Once you have determined exactly where the false e-mails are or are not coming from, then get back with us and we can help you farther.
HI ppl
its not just agent_steal who is confused, its me too. I dunno what is the reason for mails being sent from MS Outlook, and am mighty confused.
moxnix , the mails are being sent to contacts in my address book :-(
I would do as you suggest and check the activity.
Besides it would be of great help to me if anybody could tell me how to identify whether there is a trojan on my comp.
Here is what you need to do:
1) as Agent_Steal suggested, run a third party online virus check. The one he suggested TrendMicro Housecall is a very good one: http://housecall.trendmicro.com/hous...start_corp.asp
2) Get the Cleaner by Moosoft ( it has an evaluation period so it will doit for free) and use it : http://www.moosoft.com/
3) Use both of them and clean your system
4) When you have a clean system, uninstall your present antivirus and then reinstall it or another one and update it to the current definitions.
5) Change your password on all your accounts (and make them good ones)
6) Let us know your results (we are the curious type).
Desolation_Jam
[QUOTE]Besides my comp is behind a corporate firewall[QUOTE]
Does this mean that you are in a buisness enviroment and if so what do you know about the computer infrastrusture in you buissness. It may not be a virus but someone playing with your mail account. If you are at home then follow the advice given above.
edit moxnix got straight to the point before me. :)
Well MURACU
we have here is huge intranet spanning the globe...very huge, athough we have a department to look after such affairs I would ( being the curious type too ) want to solve the problem myself.
I am trying out what u said moxnix.
Ok,
If after scanning with your updated antivirus your machine is clean then the problem may not be on your computer. As Monix said change your passwords both for your mail and your windows session (if using windows). The problem may be that someone else is using your account. If you are able to install new antivirus software i suppose that means you have administrator rights on your computer. It could also mean that other people have administrator rights on the computers in you service.
I am looking at this from the point of view that your antivirus is up to date and you have no virii. this also means no trojans as they would also be detected. If this is the case you might need the help of your computer departement as you will have to try to find the culprite over you whole network. If you are lucky it will be your friend in the next office playing a joke on you. If not you might have a serious security breach. If you want a bit more information on virii and trojans then i would suggest you do a quick serch on google, yahoo etc. I done one and the first site I found was :
trojan definition
It seems to be fairly clear. If need more detailed information then post yuor question and you will get all the information you need.
It is good that you keep the details of you network to yourself till you have some idea of who you are talking to. :)
hope that helps
cheers
Couple of quick questions that might help narrow this down in a more efficient manner......
1. How do you know mail is going outbound from your Outlook by itself?
2. If it's your friends telling you they are receiving mail are they only reading the "From:" line and it says you or are they digging deeper - mail headers?
3. How many _provable_ instances of this occurring have taken place?
4. What is the content of the emails, is there an attachment, what is the subject line?
HI MURACU and Tiger_Shark and other antionliners,
I have found that the mails being sent are not only to those in my address list , but some weird recepients too. How I get to know that emails are being sent ? well
1. my friends are say "what mail have u sent ?, can't make head or tail of it "....even though I havent sent mails to them
2. mailer daemon notifying me that my email was not delivered to (weird) recipient.
The frequency of mails is random, couldnt find a particular pattern. In a day roughly twenty mails are being sent.
I tried to search for Trojans ... by some utility that associates ports to the processes , but could not find anything fishy, but considering I am a newbie I can be foooled easily I agree.
The plan of action I suppose will be as MURACU suggested, change my passwords. Will do so and see wass up.
And for information
1. My antivirus signature are most uptodate. <--- can this mean some virus in the LAN to which my comp is connected could be responsible for this ?
If yes then how do I get rid of the menance ?
Desolation: Your email is not sending out these mails. Someone you know, that has you in theor address book or elsewhere on their PC has been infected with a virus, (probably MyDoom). It is sending out mail with your name picked randomly from the address book of the victim. The "returned mail" messages you are getting are being returned to you because that is "apparently" who sent it to their mail server and the account is no longer valid.
I get this all the time with my users..... You have nothing to worry about.
Yep,
This is a common confusion in a corporate environment. The addresses in your address book will be repeated in a lot of your colleagues' books as well, because you work and do business with the same people.
If you are using SMTP mailing you might like to look at:
http://www.internals.com
"Mail Control" by Yariv Kaplan.
It asks for confirmation of all mails you send out, which is a good way to stop these mass mailing proggys from spreading, and it also warns you if you do have a problem on your local machine.
You might like to mention it to your security guys?
Cheers
You might also want to tell your IT guys that if they haven't already done it to block outbound SMTP from all but authorized machines, (mail servers), at the firewall. Then even if they do get infected it doesn't make your company look bad when it sends out these mails because they can't get out of your network anyway.
hi ppL
this really means that someone's else's comp is infected and not mine. Will tell my support anyway.
Thanks Tiger and thanks nihil
Desolation
Hey Desolation Jam:
Sorry bout the hard time I gave you in the other thread, bt thanks for being a good sport about it. Did you ever get anywhere with it. Memory and I had a chat and changed my mind about the scenario, do if you didn't, PM me and I'll see if I can help. (would post it in the forums, but don't want the kiddies to see it.)