E-mail Spam

Ok my e-mail is sending spam. I'm using outlook express. I'm on a cable modum with Roadrunner. I contacted Roadrunner and they replied it's my problem..find a way to fix it..not in those exact words.
I have the Norton internet security 2004 installed and updated. I have run Spybot search & destroy,TDS Professional3,Norton virus checker,McAvee Striker. Nothing has been found. But on my wife's e-mail account she is still getting returned mail that she has not sent. Certain ISP's will not allow us to send e-mail to family and friends because of the spam complants. I'm at my wit's end. What do I do next..what can I check..is there another program that can destroy this trojan? thanks.

There are a few possible ways to figure this out...

What i would do is hit http://www.sysinternals.com/ and download tcpview. Run it and look at what programs are accessing the internet. If you see something you don't recognise, then search your computer for that file and maybe do a google search, if you still don't know what it is, end the connection, and delete the file. At this time you would also have to go through the registry and delete all mentions of that file. One place of note is hkey_local_machine\software\microsoft\windows\currentversion\run. This section of the registry tells windows what third party programs should be run at startup. This is normally the place where viruses and backdoor programs will start.

If you get a message like "access denied, file is in use" then press ctrl+shift+esc, go to the processes tab, and kill the program if you see it running there.

Don't you just love spammers?

Also, after this... hit windows update, update your virus stuff... blah blah blah. You actually probably got this program by not adopting secure computing practices... you downloaded some "fun game" that was a trojan, or opened an e-mail attatchment that you shouldn't have.

Thanks. I'll go to that link.

Quote:

---

But on my wife's e-mail account she is still getting returned mail that she has not sent.

---

This may actually be the work of a virus. There are some viruses that mimic the response of rejected email. In addition, there are some viruses that "spoof" their source, creating the illusion of spam. Are the "apparent" spam that's being sent out going with an attachment by any chance?

If you want to ensure you aren't infected (some worms/viruses will "disable" your AV) take a visit to TrendMicro's Housecall. It's a free online AV scanner. It might pick up whatever others missed.

Netsky had a smtp engine in it, could possibly be that. But along with tcp view, I would also recommend foundstones fport, found on their website. It will map the applications opening ports. Then run your scanning utilities in safe mode, press f8 before windows starts up to select it.

Update everything beforehand. Netsky is sorta-new.

Quote:

---

MSM, i thought that too, but he said that some ISPs had blocked his e-mail account. So I doubt it's a virus

---

That may be for another reason. One of my ISPs blocks email it thinks comes from somewhere other than source -- and never has there been a spam message from some of these. It's a "default check" kind of thing. The messages the wife is receiving is probably the activity of a worm/virus.

The ISP blocking the email due to "spam" could either be a default for the whole of his ISP (which means dealing with the ISP or using another source email to send messages to those people) or getting those people who's ISP is blocking him to remove it (place his email addy on an "Acceptable" list). So in effect there may be two seperate issues here.

Quote:

---

Originally posted here by Soda_Popinsky
Netsky had a smtp engine in it, could possibly be that. But along with tcp view, I would also recommend foundstones fport, found on their website. It will map the applications opening ports. Then run your scanning utilities in safe mode, press f8 before windows starts up to select it.

Update everything beforehand. Netsky is sorta-new.

---

a lot of the mitglieder trojans dropped by bagel have smtp relaying capabilities.

I'd get a more 'obvious whats going on' firewall such as kerio or sygate. both do free personal firewalls.

Quote:

---

I'd get a more 'obvious whats going on' firewall such as kerio or sygate. both do free personal firewalls.

---

Only if he knows what to look for and prevent from happening. Otherwise, if it's misconfigured (that is, the user lets everything through because they think it's required) then it's not that helpful.

I just ran Housecall..nothing..computer's clean. The ISP's blocking e-mail that I talked about was not my IPS. Other ISP's sent me e-mail informing me that I was on the blocked list because of complants of spam coming from me.

This is a copy of a returned e-mail..from my account. That I did not send..nor do I know this person. I blanked out his e-mail address.

Your message

To: ...............com
Subject: Your details
Sent: Wed, 28 Apr 2004 18:39:09 -0500

did not reach the following recipient(s):

..............COM on Wed, 28 Apr 2004 18:39:02 -0500
The recipient name is not recognized
The MTS-ID of the original message is:
c=us;a=attmail;p=columbia;l=CORPEXCON010404282339JWB5KYDX
MSEXCH:IMS:Columbia:Corp:CORPEXCON01 0 (000C05A6) Unknown Recipient


This is an example of a message I recieved from other ISP's.


The original message was received at Sun, 25 Apr 2004 21:27:43 -0500 (CDT)
from cs6669105-183.satx.rr.com [66.69.105.183]

----- The following addresses had permanent fatal errors -----
<[email protected]>
(reason: 591 your host [24.93.47.43] is blacklisted by bl.spamcop.net. Send your questions to [email protected])
<[email protected]>
(reason: 554 5.7.1 24.93.47.43: blacklisted by real-time blacklist bl.spamcop.net For assistance, please email [email protected])

----- Transcript of session follows -----
... while talking to mail2.evdloh.cablespeed.com.:
>>> DATA
<<< 591 your host [24.93.47.43] is blacklisted by bl.spamcop.net. Send your questions to [email protected]
554 5.0.0 Service unavailable
<<< 554 no valid RCPT address specified
<[email protected]>... Deferred: Connection refused by relay.cisp.com.
... while talking to mx0.dixie-net.com.:
>>> DATA
<<< 554 5.7.1 24.93.47.43: blacklisted by real-time blacklist bl.spamcop.net For assistance, please email [email protected]
554 5.0.0 Service unavailable
<<< 503 5.0.0 Need RCPT (recipient)

Ok. The first one is an effect of probably Sobig.F. Unfortunately, there's not much you can do about it other than delete it.

The others have advice that you should follow:

Quote:

---

Send your questions to [email protected]

---

Quote:

---

Send your questions to [email protected]

---

Since both of those ISPs seem to be using SpamCop you may want to visit that. If you find your ISP is listed there, then get them to deal with this (it means they have an open relay). If [quote="http://www.spamcop.net/bl.shtml"]your IP[/url] is listed there, then you need to check your machine to see if you have port 25 open (this would indicate a SMTP server is running and potentially an open relay). Open relay means an SMTP server that sends emails even tho' the source address isn't valid and the IP doesn't match with the source (that is one that fits their range of IPs).

You did inadvertantly leave your IP in one of those messages so I did a check and lo' and behold I got this:

Quote:

---

Query bl.spamcop.net - 24.xx.yy.zz
24.xx.yy.zz is ms-smtp.xx.yy.zz.rr.com

24.xx.yy.zz not listed in bl.spamcop.net

Since SpamCop started counting, this system has been reported about 20 times by less than 10 users. It has been sending mail consistently for at least 62.4 days. In the past 20.7 days, it has been listed once for a total of 23 hours

* In the past week, this system has: Been witnessed sending mail about 5580 times

A sample sent sometime during the 24 hours beginning Thu Apr 22 20:00:00 2004 -0400:
Received: from -.-.-.com (-.-.-.com [24.93.47.43])
by -.-.net (-.-.-.-.-) with - id -
for <[email protected]>- Fri, - Apr 2004 - -
Subject: attention - bonnie
From: li.. at ..h.com

A sample sent sometime during the 24 hours beginning Mon Apr 5 20:00:00 2004 -0400:
Received: from -.-.-.com (-.-.-.com [24.93.47.43])-
by -.-.net (-.-.-.-.-) with - id -
Mon, - Apr 2004 - -
Subject: - hello - sweetheart
From: sk.. at ..l.net

---

The bolded section is interesting. Unless you're running the email server, someone has. And given the name ms-smtp makes me think Microsoft SMTP (exchange?).

Do a quick netstat -a and see if port 25 is open. If not, then you need to go and talk with Road Runner about their policies (talk to a manager not one of the flakes on the front line)

I have got these mysterious returned mails in my hotmail also. But hotmail.... I am not using Outlook express, how could this happen?

Quote:

---

reason: 591 your host [24.93.47.43] is blacklisted by bl.spamcop.net.

---

Is this your IP address? When I checked it, it seemed to be roadrunner's mail server.

Quote:

---

[rcgreen@acer rcgreen]$ telnet 24.93.47.43 25
Trying 24.93.47.43...
Connected to 24.93.47.43.
Escape character is '^]'.
220 ms-smtp-04.texas.rr.com ESMTP Welcome to Road Runner. WARNING: *** FOR AUTHORIZED USE ONLY! ***

---

Otherwise, you have a trojan running a mail relay on your machine.
:cool:

Quote:

---

I have got these mysterious returned mails in my hotmail also. But hotmail.... I am not using Outlook express, how could this happen?

---

spellabc, might be the same reason I pointed out earlier: someone else is infected with a virus (possibly Sobig.F) and it's generating fake returned mails or is using your address as the source of emails being sent out to fake destinations (thus resulting in you getting the return email along with the infected attachment -- although I believe that hotmail removes infected attachments).

MsMittens--
Funny you mentioned port 25. Yesterday I ran a scan with TDS-3 on my ports and 25 was open. TDS-3 closed it.

Ok..I just checked again this AM. Port 25 is open again. How do I close it and keep it closed?

Zetin, sounds like there is indeed a mail server running on your machine then. One way to find it would be to run netstat -aop (in respective order, this will show all connections and listening ports, what process is running each service that is listening and what protocols are being used -- usually UDP or TCP). Another tool that might be helpful is ProcessExplorer which also might show "unusual" processes.

Are you by any chance running IIS and which version of Windows are you running?

IIs? We are running Windows XP

IIS is Internet Information Services and is an add-on that provides web, ftp, gopher and smtp. I asked because often when it's setup the default is to have SMTP on. You need to find the process running SMTP (simple mail transfer protocol)