Tech: return emails I never sent ???

Subject: BS: retun emails I never sent ???
From: Art Thieme
Date: 02 Nov 02 - 01:22 PM

Lately these have been coming back to me by the carload. What is this all about? I never sent them in the first place.

Art Thieme

Subject: RE: BS: retun emails I never sent ???
From: Art Thieme
Date: 02 Nov 02 - 01:24 PM

That ought to read "return". Sorry!

Art

fixed it for you -el joeclone-

Subject: RE: BS: retun emails I never sent ???
From: MMario
Date: 02 Nov 02 - 01:26 PM

Art - do you have an updated virus checker on your machine? This is a symptom of several of the latest generation "worms"

Subject: RE: BS: retun emails I never sent ???
From: Ebbie
Date: 02 Nov 02 - 01:27 PM

Spam?

Subject: RE: BS: retun emails I never sent ???
From: Jeri
Date: 02 Nov 02 - 01:31 PM

Art, I get replies to e-mails I never sent. They're spam.

If you e-mail them to tell them you never sent anything, you've confirmed your address is a good one to send more spam to.

Another idea - if these things look like real e-mail - maybe someone has an address similar to yours and put your address in "Reply To."

Subject: RE: BS: retun emails I never sent ???
From: MudGuard
Date: 02 Nov 02 - 01:32 PM

It is technically easily possible to fake the sender's address when sending mail.

So if I want, I can send with any email address as sender's address. Of course, when someone replies or when the mail can't be delivered, these answers go to the mailers address.

So if I chose your email address as sender's address and send an email to someone else, that someone might think the email came from you...

Of course, though I know how to do that, I won't do it.

Subject: RE: BS: retun emails I never sent ???
From: Bernard
Date: 02 Nov 02 - 01:35 PM

More than likely people you know have had their systems infected with the Klez worm, Gibe worm, Bugbear, or a similar 'virus'.

These randomly pick names from the system's address book, sending mail to one address as if it came from another, using random text from the infected machine. As the mail contains the virus, it will be returned to the apparent 'sender' by some systems.

There is also a possibility your system has the virus...

Symantec - Klez info and fix

Symantec - Gibe info and fix

Symantec - Bugbear info and fix

Subject: RE: BS: retun emails I never sent ???
From: Jeri
Date: 02 Nov 02 - 01:35 PM

Do the messages say why they were returned?
If MMario's right, there's probably a note about the e-mail being refused because of a virus.

Subject: RE: BS: retun emails I never sent ???
From: DMcG
Date: 02 Nov 02 - 01:49 PM

MudGuard is right about how easy it is to fake email addresses. I do it about once a quarter when a manager tells me they want email from a certain address sent through our virus programs unchecked 'because they can trust' that address. I tell them I'm about to send a fake email from that address and about a minute later they recieve it.

They tend to be a little more careful about security after that.

Subject: RE: BS: retun emails I never sent ???
From: Devilmaster
Date: 02 Nov 02 - 01:53 PM

Art, go to Housecall online virus checker and click on scan without registering.

This is a daily updated online virus checker that I find works really well. Use this in conjunction with your own virus software.

When housecall scans, if it finds a virus, click on the virus' name in the scanning box, that will open a link to housecall's online database, which contains information on how and/or a small program to ensure proper cleaning.

Like the others have said, this definitely sounds like a virus.

Hope it works out

Steve

Subject: RE: BS: retun emails I never sent ???
From: Jeri
Date: 02 Nov 02 - 02:09 PM

I think Bernard's sounds like the most likely explanation. If the e-mails weren't written by you and are harmless in content, they're probably coming from someone else's infected machine.

Subject: RE: BS: retun emails I never sent ???
From: Mary in Kentucky
Date: 02 Nov 02 - 02:13 PM

Art, what do you mean when you say they are coming back to you?

1) Is your address in the header?

or 2) Does the subject line of a spam say "RE: somethingorother

or 3) Does your email program say that the letter is from "your email address"

I get spams that have "RE: Tell me about your $$$$$$ offer" in the subject line. (the RE: makes it look like it is a reply.) I also get spams that show up as from my email address. Since my emails have my name and not my email address, I know they aren't from me.

If you're interested in fighting spam, one thing you can do is register at SpamCop. It takes a little time to follow all the instructions, but it really seems to work. I know that my ISP got blocked by another ISP close by geographically because someone was sending spam from my ISP. I couldn't send email to a friend here in town, so I complained to my ISP until they did something about it. I don't know if they shut down the spammer, but at least someone received a lot of attention. I turn in very few spams, but once I got one so pornographic (pictures actually inserted in the email) I got great delight in turning them in.

Subject: RE: BS: retun emails I never sent ???
From: Jim McLean
Date: 02 Nov 02 - 04:43 PM

Bernard and Jeri's replies are most likely to be correct. As a computer trouble shooter I deal with this problem regulary. Sometimes the returned emails are dated at a time when you couldn't possible have sent them which proves they are coming from someone else's address book.
Cheers,
Jim mclean

Subject: RE: BS: retun emails I never sent ???
From: GUEST, NOMADman
Date: 02 Nov 02 - 04:54 PM

One other thing to check: the file size. Is it over 100KB? If so, it probably is the Klez virus or something like it. An ordinary returned e-mail would likely be only a couple of KB.

Regards,
John

Subject: RE: BS: retun emails I never sent ???
From: Willie-O
Date: 02 Nov 02 - 04:55 PM

Two things to check in the return address:

1. the time, as Jim mentions
2. Is it the name of a person known to you, but the rest of the address is wrong?

If the second one is the case, and the message has an attachment with a generic name "kids.jpg" etc, its probably the Bugbear virus.

It fiddles the from address so if you follow your instinct of clicking on "Reply" and asking if it's a legit message, it won't get to the person whose name is on it.

One annoying thing is that people who get it will think you sent them a virus, but only the ones that double check the email address, or phone you, will get through to you.

The other thing, though, is that if you are infected with any virus that raids your address book and sends itself off to people, well if you are like me you have a lot of outdated addresses in your email address book. Those are the ones that generate the bounce messages you describe at the beginning of the thread. So check out your own machine for those nasties.

Subject: RE: BS: return emails I never sent ???
From: Liz the Squeak
Date: 02 Nov 02 - 07:35 PM

It could be a piggybacker, someone who's pulled your address off some listing somewhere, and is using it as Mudguard explained above.... I had some trouble earlier this year with the same sort of problem. I closed one of my accounts and it's gone.

LTS

Subject: RE: BS: return emails I never sent ???
From: Art Thieme
Date: 03 Nov 02 - 07:48 PM

People, thank you.

All 28 e-mails seem to have come through a single mail delivery subsystem. All indicate "Invalid Recipient" and all are from e-mail addresses that were not ever in my address book. All the addresses start with the letters "ma" and variations after that.

There have been others----but never this many together. Sometimes just individually returned. But never an e-mail address I recognize.

Wold installing an updated virus chaser like Norton aid me in this?

Art Thieme

Subject: RE: BS: return emails I never sent ???
From: Bernard
Date: 03 Nov 02 - 08:04 PM

That's definitely worm activity... get Norton 2003 installed as soon as you can, and run LiveUpdate immediately installation has completed (default), because it's only a matter of time before the worm arrives on your system (if it hasn't already).

One slight problem - if the worm is already there, it will not allow a virus checker to install correctly... let's hope you've been lucky. Best download the 'fixes' from Symantec and run them - it can't do any harm if the worms aren't there, and will identify and 'clean' them if they are. Follow the instructions they provide very carefully.

Good luck, chum - them worms ain't funny...

Subject: RE: BS: return emails I never sent ???
From: Bill D
Date: 03 Nov 02 - 08:18 PM

Art...Norton would not likely do much good in these kind of things, as it doesn't look like it's you who is infected......if you WANT a good virus checker, there is AVG anti-virus (free)

I use it and it will update itself regularly.

Subject: RE: BS: return emails I never sent ???
From: Bill D
Date: 03 Nov 02 - 09:08 PM

hmmm...well...maybe Bernard knows something...hard to be sure what it is..

Subject: RE: BS: return emails I never sent ???
From: Bernard
Date: 04 Nov 02 - 10:37 AM

Bill - all I'm suggesting is that if Art hasn't got AnitiVirus protection, one or more of those worms is going to get on his system sooner or later, particularly if people he knows are already infected.

Is that any clearer?! ;o)

Subject: RE: BS: return emails I never sent ???
From: Steve-o
Date: 04 Nov 02 - 04:41 PM

I've got these worms IN SPADES on my home computer, and I shall do just as you say. THANK YOU, Bernard!

Subject: RE: BS: return emails I never sent ???
From: RangerSteve
Date: 04 Nov 02 - 05:25 PM

I had a similar problem. I got emails stating that the emails i sent were refused. These emails that I hadn't sent were going to websites that I had visited. I started a thread about it here, and was told that I probably had a virus. I took the computer to a repair place and they cleaned it out. I actually had quite a few visuses. They also put in a Norton virus protector, which updates itself automatically, and is much better than the McAfee virus shield that came with the computer. It cost 110 Dollars, but it was well worth the money.

Subject: RE: BS: return emails I never sent ???
From: gnu
Date: 05 Nov 02 - 04:44 AM

Odd that I should find this thread first thing this morning. I was just attacked in the same manner four times, along with one email from Custy's Music Shop informing those on Custy's mailing list that their audio files are fouled up. Haven't seen one of these in several weeks.

As for scanning and anti-virus programs/packages, I don't use them. I simply refuse to open any attachments from anyone. If they can't put whatever they are sending in the body, I don't get it. It's inconvenient, but it works.... so far. Am I okay with this procedure ?

Subject: RE: BS: return emails I never sent ???
From: Bernard
Date: 05 Nov 02 - 03:04 PM

Nope. The latest worms take advantage of 'vulnerabilities' in web browsers and e-mail programs, though these are typically the Microsoft ones.

The worm is often hiding in the body of an HTML email, so the absence of an attachment is no guarantee. Make sure the 'size' field is displayed in your inbox - a text e-mail is usually no bigger than 6k, but wormed mail will be much larger (Klez is often around 130k, for example).

In other words, you don't need to actually open some of them, they activate when they arrive on an unprotected system, resulting in them spreading even further (I received 'Klez' twice today, and one was a 'returned' e-mail).

The people who write them claim they are trying to demonstrate how bad Microsoft software is, but I'm sure you'll agree that's a bit of a lame excuse. Dogs lick their nuts because they can...

The only way to combat them is to use any means available to ensure they cannot proliferate. One way is to use good antivirus software, and another is to make sure you keep up with update 'patches' to your operating system, which are designed to block the holes the worms use to get in. A bit like bolting the horse after the stable has gone... or summat!

A good analogy is fleas... if all animal owners made sure their pets were kept clean of fleas, the fleas would eventually die out...!

All a bit daft, really...

Subject: RE: BS: return emails I never sent ???
From: gnu
Date: 07 Nov 02 - 05:48 AM

Thanks. I'll get some protection.

Subject: RE: BS: return emails I never sent ???
From: JedMarum
Date: 07 Nov 02 - 09:36 AM

Yes - this is a technique used by viruses to get you to open the email and /or its attachment. Throw them away. You know what you send and what you don't - if you didn't send it don't open it!

Subject: RE: BS: return emails I never sent ???
From: Rara Avis
Date: 07 Nov 02 - 01:52 PM

I routinely get messages that an email I supposedly sent was undeliverable. The sender has the same webname as I do but the ISP is different. I know that it's very likely my webname is not unique but I always wonder why a message from [e-mail] is returned to me (at a different ISP) as undeliverable. Computer mystery?

Subject: RE: BS: return emails I never sent ???
From: Art Thieme
Date: 07 Nov 02 - 09:21 PM

Semantec and Norton found four of them. Three they cleaned out. The fourth one wasn't washable. I stuck it into quarantine and figure I'll scan once a week or even more often. Hope I'm clean.

Thanks for all the advice.

Art Thieme

Subject: RE: BS: return emails I never sent ???
From: GUEST
Date: 08 Nov 02 - 09:42 AM

Same problem but different it appears that I am sending e-mails but the are not being recieved.

Subject: RE: BS: return emails I never sent ???
From: Art Thieme
Date: 08 Nov 02 - 03:27 PM

So they get sent back to you 'cause they were sent with your email address as the return path.

Art

Subject: RE: BS: return emails I never sent ???
From: Bernard
Date: 09 Nov 02 - 09:27 AM

If it won't clean, delete it - it will just be the worm, and you don't need it hanging around! The file containing it isn't of any use to you.

Glad you avoided an infection - very inconvenient when it happens! Surprising how much we depend on these little boxes of bits these days - I can remember when we thought a slide rule was hi-tech!!

TTFN

B