Tech: Has my PC been captured?

Subject: RE: Tech: Has my PC been captured?
From: GUEST,Mike in DC
Date: 29 Mar 08 - 03:58 PM

Every so often I'll get one of those automatic response e-mails from people informing me that they will be out of the office until next Thursday and telling me whom to call in case of emergency. I don't know these people and have not intentionally e-mailed them. So does this mean that my PC has been captured and integrated into some massive spambot? Are people getting e-mails from me offering them great deals on Canadian Viagra or worse? (Nothing against either Canada or Viagra, mind you.) If so, can I do anything about it? I am running XP SP2 by the way, use Firefox and have Nortion Antivirus. Thanks.

Mike

Subject: RE: Tech: Has my PC been captured?
From: Jeri
Date: 29 Mar 08 - 04:02 PM

Mike, if you're on any mailing lists, that's probably where the 'out of office' person is sending them, then they get forwarded to everybody on the mail list.

Subject: RE: Tech: Has my PC been captured?
From: Uncle_DaveO
Date: 29 Mar 08 - 04:09 PM

Are you a participant in an e-mail distribution list? I am, in Banjo-L, Ballad-L, Frailing-L, and BanjoBuddies(-L?).

From time I get an "out of office" which I have difficulty accounting for, and eventually it turns out that Joe Blow, a member of a list from which the message comes, is part of whatever the -L.    Not all distribution lists show more than the name of the individual sender on the "From" line of my email system's screen.

Is it possible that something like that is happening with you?

Dave Oesterreich

Subject: RE: Tech: Has my PC been captured?
From: Big Mick
Date: 29 Mar 08 - 04:18 PM

Recently I received a spam mailing for pharms that ended with a Georgia State Government address. In fact it was from someone who worked in the Georgia Department of Labor (how apropos!). I jotted off a note to their tech folks who came back and told me the address was not valid and had been hijacked. The told me that anyone who has email likely gets hijacked.

Mick

Subject: RE: Tech: Has my PC been captured?
From: GUEST,Mike in DC
Date: 29 Mar 08 - 04:40 PM

Jeri and Dave
I used to be on Irtrad-L but haven't been for several years. This is a more recent phenomenon. I would be delighted to find out that there was a benign explanation for this though.

Mike

Subject: RE: Tech: Has my PC been captured?
From: treewind
Date: 29 Mar 08 - 05:34 PM

Some spam sender's got your email address and is pasting it into the "From" address of some of the emails it sends out. You can't stop it happening and it has nothing to do with your own computer. Spam always uses fake "From:" addresses, usually picked at random from the same list the spammer's using for "To:" addresses.

Exactly the same reason explains why you can get bounce messages (e.g. "MAILER-DAEMON" says your message is undeliverable) relating to a message you never sent, that may also be to an address that you've never heard of. I certainly get a few of those.

Anahata

Subject: RE: Tech: Has my PC been captured?
From: GUEST,Tangledwood
Date: 29 Mar 08 - 06:45 PM

Also never reply to any of them. It only confirms to the spammer that they have found a valid address.

Subject: RE: Tech: Has my PC been captured?
From: Peace
Date: 29 Mar 08 - 06:49 PM

"RE: Tech: Has my PC been captured?"

If you went to sleep in London and woke up on Venus, indeed your Personal Corpus has been captured.

Subject: RE: Tech: Has my PC been captured?
From: GUEST,Acorn4
Date: 29 Mar 08 - 06:53 PM

I think it can mean that although your PC hasn't been captured, someone elses has who have you in their address book.

Subject: RE: Tech: Has my PC been captured?
From: Amos
Date: 29 Mar 08 - 07:02 PM

Mike:

Sometimes a sneaky evil spam merchant will steal your email addy from somewhere and use it as the "From:" header in their spam, spoofing it to look like you sent it out. THis would account for what you experience. To be in the safe side, it should be forwarded with all headers to your ISP's security office explaining what has happened. Just so you have a record in case someone takes it seriously, ya know.


A

Subject: RE: Tech: Has my PC been captured?
From: Jack Campin
Date: 29 Mar 08 - 08:24 PM

The commonest way this happens is when you end up in the address book of somebody who uses a Microsoft email program. Their system gets penetrated by malware, the address database gets passed on to a spammer or adopted as an alias by a viral remailer, and suddenly everybody the dimwit Microsoft user knows is getting spam or virus emails purporting to be from you. Chances are many of them will be too thick to understand any explanation of why it isn't your fault.

I have a few spare email accounts whose addresses I don't give out to anyone using MS software of any kind, so I'll always have a bolthole when the spam load makes all the others inoperational.

Subject: RE: Tech: Has my PC been captured?
From: GUEST,.gargoyle
Date: 29 Mar 08 - 10:54 PM

What do you use for a

FIREWALL?

You NEED one!!!

Sincerely,
Gargoyle

Subject: RE: Tech: Has my PC been captured?
From: JohnInKansas
Date: 29 Mar 08 - 11:01 PM

Nothing that you receive can be taken as an indication of infection of your own machine, without significant other clues. In this case the usual assumption would be that someone is using the sender's address in an attempt to get to your machine, but probably isn't there ... yet.

If your own sent box contains items you didn't intentionally send, there's a better likelihood that someone has managed to get a bot on your machine and it's sending messages for someone other than you.

If you have a current version of a good antivirus, and scan with current definitions/signature files, you can be reasonably confident that your computer is not infected with a virus.

Most of the recent malicious stuff, however, is NOT VIRAL. It consists of programs, looking like normal programs, sometimes very cleverly and deeply hidden, that YOU HAVE INSTALLED. An antivirus program usually can't detect them and can't do anything about them.

The assertion that "you have installed them" comes from the fact that generally they are not placed on your machine by a virus, but come disguised as something that you are induced to "click" out of curiosity, gullibility, or nervousness. When you click, it may look like you're "just looking" but the command you click on is disguised, and it's real action is to tell your computer that you gave permission to install something.

The most common malware currently in circulation is not from people who want to use your computer to send spam, although that does still happen. The purpose is either to obtain personal information about you, for the purpose of identity theft, or to obtain control of your machine so that the creator of the malware can take over its use for attacks on others. In either case, the "excess activity" which was the most frequent reliable indicator of infection is rare, except when something like a DDOS attack is launched and is in progress.

Even if your computer "participates" in an attack, it isn't necessary that an individual computer send more than a few messages, since "botmasters" brag openly of having several thousand computers "at their command."

The malware distributor wants to avoid interfering with your normal use, since he loses control of your computer if his program is discovered and removed. That just makes it harder for you to stay safe.

A good "protection suite" now will include antivirus, antispyware, antiphishing, and a popup blocker as minimums. A simple antivirus is NOT SUFFICIENT by itself, for most users. If you have children, or a "publicly shared" computer, you may also want to add a "parental control" program as well, or turn on the feature in a program you have, to specifically block websites with certain content(s).

You can "build your own suite" by adding separate programs for each function, but if you install enough pieces to be effective you may run out of screen room to do much due to all the toolbars you'll have and that you'll need to manage constantly.

The main thing that can cause you problems is stupidly assuming that you've found some "secret" that makes you safer than the rest of the users on the internet. YOU ARE NOT SMARTER THAN THE PEOPLE WHO WANT TO HURT YOU (despite the common suspicion that many of them are government agents - not necessarily for friendly governments). Get some competent, reliable help from people who work hard at protecting you.

I don't see a reason to be overly concerned about the messages cited; but of course watching what you computer is doing for a week or so might be a good idea. I would suggest checking your sent messages folder ... just for reassurance.

John

Subject: RE: Tech: Has my PC been captured?
From: The Fooles Troupe
Date: 29 Mar 08 - 11:52 PM

As Treewind & JiK mentioned, I also get a lot of 'bounces' - my email has been around since 1996, so I expect it is now 'tarnished'.

Also note that some 'alleged bounces' can in fact be 'probes' to try to get you to respond - especially those that ask you to contact some alleged 'supervisor address' to tell if this 'bounce' is incorrect...

Subject: RE: Tech: Has my PC been captured?
From: Stilly River Sage
Date: 30 Mar 08 - 12:56 PM

Anahata, Amos, and John are correct. Delete them.

SRS

Subject: RE: Tech: Has my PC been captured?
From: GUEST,Mike in DC
Date: 30 Mar 08 - 07:31 PM

Thanks everyone. I checked my Sent folder and there's nothing suspicious in there.I practice safe computing - don't click on links from unknown sources, don't respond with personal information to requests from my bank to update my account, etc. I have been relying on Norton Antivirus and the standard Windows XP firewall, so I need to do some upgrading there. But I'm glad at least that this probably wasn't the result of something stupid that I did.

Mike

Subject: RE: Tech: Has my PC been captured?
From: GUEST,Mike in DC
Date: 30 Mar 08 - 07:58 PM

I am a little concerned about that Venus thing though Peace.

Mike

Subject: RE: Tech: Has my PC been captured?
From: GUEST,In Dubai on Laptop
Date: 31 Mar 08 - 07:00 AM

Just had a fun episode on my home PC with hundreds of returned emails from undeliverable emails that "I" had sent.

A scan with McAfee revealed nothing.

After many fun hours on the web looking for a solution I have managed to ionstall via my remote computer link "Spyware Doctor". It found 122 problems , I deleted em (for a 30 quid fee) and the emails have not continued.

Good Luck

Alan Clayton

Subject: RE: Tech: Has my PC been captured?
From: Stilly River Sage
Date: 31 Mar 08 - 08:45 AM

I think you didn't need to pay a fee to do that. And Spybot Search & Destroy is a free, robust program that would have taken out those "problems."

There are various email filters out there, and a lot of providers have spam filters. I use Earthlink and have their filters set to "high" so if you're not in my address book you land in a suspect mail file that I monitor. Emails that have all of the earmarks of true spam go strait to the trash and I don't see them.

SRS