Zombie computer

Hello

I have Windows XP with Windows Office 2003

This morning, I received some returned mail from a server as the letter
boxes were full

The problem is that I didn't send these emails which apparently were sent by
'Crazy Vente' followed by my email address in brackets (vente = 'sales' in
French and I live in France)

The message came back and it is for a site that sells on line
pharmaceuticals.

I'm running a scan now.

What do u think?

Thanks in advance

 

Dave Neve wrote:<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Hello
>
> I have Windows XP with Windows Office 2003<!--colorc--><!--/colorc-->

It's much more important for us to know the exact and *complete*
detailed version of the system's OS - not just "XP". At this point,
knowing you run Windows Office 2003 is probably unimportant.
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> This morning, I received some returned mail from a server as the letter
> boxes were full
>
> The problem is that I didn't send these emails which apparently were sent by
> 'Crazy Vente' followed by my email address in brackets (vente = 'sales' in
> French and I live in France)
>
> The message came back and it is for a site that sells on line
> pharmaceuticals.
>
> I'm running a scan now.<!--colorc--><!--/colorc-->

It's unfortunate you didn't say what precisely you're scanning with...

Avast! ???

What is your next step if your scan shows nothing?
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> What do u think?<!--colorc--><!--/colorc-->

I think all of us would know much more if you reported all of what is
in the headers of the bounced email.
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Thanks in advance<!--colorc--><!--/colorc-->

Hello Dave:

Please relate a very exact, detailed, and complete rundown on all of
your system's antimalware applications.

It would also be prudent to believe that a spammer has discovered your
email address from other sources. It's also possible that your system
could be harboring a spambot. Not enough clues yet Dave.

The devil is in the details Dave.

Research the above questions carefully and post a complete reply.

Regards.

--
1PW

 

Hi again

Windows Pro with service pack 3

The virus test was with avast and it gave no results. Nor did a Rootkit
detector.

No more suspect emails have come back either from the server
"1PW" <1PW@INVALID.com> a écrit dans le message de news:
h6rb8h$lgp$1@news.eternal-september.org...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Dave Neve wrote:<!--coloro:green--><span style="color:green <!--/coloro-->
>> Hello
>>
>> I have Windows XP with Windows Office 2003<!--colorc--><!--/colorc-->
>
> It's much more important for us to know the exact and *complete*
> detailed version of the system's OS - not just "XP". At this point,
> knowing you run Windows Office 2003 is probably unimportant.
><!--coloro:green--><span style="color:green <!--/coloro-->
>> This morning, I received some returned mail from a server as the letter
>> boxes were full
>>
>> The problem is that I didn't send these emails which apparently were sent
>> by
>> 'Crazy Vente' followed by my email address in brackets (vente = 'sales'
>> in
>> French and I live in France)
>>
>> The message came back and it is for a site that sells on line
>> pharmaceuticals.
>>
>> I'm running a scan now.<!--colorc--><!--/colorc-->
>
> It's unfortunate you didn't say what precisely you're scanning with...
>
> Avast! ???
>
> What is your next step if your scan shows nothing?
><!--coloro:green--><span style="color:green <!--/coloro-->
>> What do u think?<!--colorc--><!--/colorc-->
>
> I think all of us would know much more if you reported all of what is
> in the headers of the bounced email.
><!--coloro:green--><span style="color:green <!--/coloro-->
>> Thanks in advance<!--colorc--><!--/colorc-->
>
> Hello Dave:
>
> Please relate a very exact, detailed, and complete rundown on all of
> your system's antimalware applications.
>
> It would also be prudent to believe that a spammer has discovered your
> email address from other sources. It's also possible that your system
> could be harboring a spambot. Not enough clues yet Dave.
>
> The devil is in the details Dave.
>
> Research the above questions carefully and post a complete reply.
>
> Regards.
>
> --
> 1PW <!--colorc--><!--/colorc-->

 

Dave Neve wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> This morning, I received some returned mail from a server as
> the letter boxes were full
>
> The problem is that I didn't send these emails
> What do u think?<!--colorc--><!--/colorc-->

Your e-mail address was used as the return address for a spam campaign.
This is sometimes known as a "joe job".

There is probably nothing wrong with your computer (ie virus or
trojan). Even if you did have a trojan responsible for generating these
e-mails, it's highly unlikely it would have used your e-mail address as
the return address for them.

There are several theories about joe-jobs. One is that your address was
chosen specifically as the return address fot a spam campaign because
someone has a personal grudge against you or your domain, or wanted to
cause a DoS against your e-mail server by causing a flood of return
messages. A second reason is more likely - legit addresses are
frequently chosen as the return address for spam simply because a legit
return or reply-to address will help e-mail get through spam filters.

In the future, it's a good idea to compose your subject line to better
reflect the question you pose in the body of your message. For example,
you could have said:

"Getting returned email that I didn't send - is my computer a zombie?"

as your message subject.

 

On Sun, 23 Aug 2009 09:40:33 +0200, "Dave Neve" <neve.dave@neuf.fr>
wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
>Hello
>
>I have Windows XP with Windows Office 2003
>
>This morning, I received some returned mail from a server as the letter
>boxes were full
>
>The problem is that I didn't send these emails which apparently were sent by
>'Crazy Vente' followed by my email address in brackets (vente = 'sales' in
>French and I live in France)
>
>The message came back and it is for a site that sells on line
>pharmaceuticals.
>
>I'm running a scan now.
>
>What do u think?
>
>Thanks in advance
><!--colorc--><!--/colorc-->

Your computer is probably not a zombie but it's good to run a full
scan periodically.

As Virus Guy described, it's not unusual for a legitimate email
address to be used as a return address for spam. Spammers will often
use your own email address as their return address to make it harder
for you to filter it.

You can determine if your computer sent the emails by closely checking
the headers of the bounced email to see what IP originated the email.
If it wasn't an IP address that your computer is/was assigned then you
can be pretty sure it wasn't your computer that sent them.

 

Thanks everyone

As my IP address is dynamic, I don't quite see how I can check if it was my
address as I haven't kept a record of all my connections and the IP address
each time.

As for the 'joe job', I thought that someone could only use my address if
they connect using it and to do that, they need the password etc.

Finally, I won't even go into the grudges thing cos that would take at least
a week (I'm a Trade Union official!!!)

Thanks
"Geoff" <geoff@invalid.invalid> a écrit dans le message de news:
esh295121rs8ojfptictl66bsgk77nuj6n@4ax.com...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> On Sun, 23 Aug 2009 09:40:33 +0200, "Dave Neve" <neve.dave@neuf.fr>
> wrote:
><!--coloro:green--><span style="color:green <!--/coloro-->
>>Hello
>>
>>I have Windows XP with Windows Office 2003
>>
>>This morning, I received some returned mail from a server as the letter
>>boxes were full
>>
>>The problem is that I didn't send these emails which apparently were sent
>>by
>>'Crazy Vente' followed by my email address in brackets (vente = 'sales' in
>>French and I live in France)
>>
>>The message came back and it is for a site that sells on line
>>pharmaceuticals.
>>
>>I'm running a scan now.
>>
>>What do u think?
>>
>>Thanks in advance
>><!--colorc--><!--/colorc-->
>
> Your computer is probably not a zombie but it's good to run a full
> scan periodically.
>
> As Virus Guy described, it's not unusual for a legitimate email
> address to be used as a return address for spam. Spammers will often
> use your own email address as their return address to make it harder
> for you to filter it.
>
> You can determine if your computer sent the emails by closely checking
> the headers of the bounced email to see what IP originated the email.
> If it wasn't an IP address that your computer is/was assigned then you
> can be pretty sure it wasn't your computer that sent them. <!--colorc--><!--/colorc-->

 

"Dave Neve" <neve.dave@neuf.fr> wrote in message
news:O4BTEU8IKHA.4232@TK2MSFTNGP02.phx.gbl...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Hello
>
> I have Windows XP with Windows Office 2003<!--colorc--><!--/colorc-->

Are you using the possibly affected computer to make this post - is
Outlook Express still your e-mail client?
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> This morning, I received some returned mail from a server as the
> letter boxes were full<!--colorc--><!--/colorc-->

Your computer could be a zombie, or your webmail (pick one) account
could be hijacked, or some spammer may be using your address as a return
address. The likelihood is in the reverse order (last being most
likely).
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> The problem is that I didn't send these emails which apparently were
> sent by 'Crazy Vente' followed by my email address in brackets (vente
> = 'sales' in French and I live in France)<!--colorc--><!--/colorc-->

Sounds even more like it is spam related, but what malware isn't these
days.
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> The message came back and it is for a site that sells on line
> pharmaceuticals.<!--colorc--><!--/colorc-->
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> I'm running a scan now.<!--colorc--><!--/colorc-->

What online pharmaceutical scanner are you using?
(okay, just kidding with that one)

What scanner(s) are you using?
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> What do u think?<!--colorc--><!--/colorc-->

The headers of the returned e-mails could provide clues, but take care
not to expose actual e-mail addresses here unless they are disposable.
This is one place that spammers have been known to "harvest" e-mail
addresses from.

 

There is an important distinction between someone using your e-mail
address and someone using your e-mail account.

"Dave Neve" <neve.dave@neuf.fr> wrote in message
news:OGpYQ0BJKHA.1252@TK2MSFTNGP04.phx.gbl...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Thanks everyone
>
> As my IP address is dynamic, I don't quite see how I can check if it
> was my address as I haven't kept a record of all my connections and
> the IP address each time.
>
> As for the 'joe job', I thought that someone could only use my address
> if they connect using it and to do that, they need the password etc.
>
> Finally, I won't even go into the grudges thing cos that would take at
> least a week (I'm a Trade Union official!!!)
>
> Thanks
> "Geoff" <geoff@invalid.invalid> a écrit dans le message de news:
> esh295121rs8ojfptictl66bsgk77nuj6n@4ax.com...<!--coloro:green--><span style="color:green <!--/coloro-->
>> On Sun, 23 Aug 2009 09:40:33 +0200, "Dave Neve" <neve.dave@neuf.fr>
>> wrote:
>><!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>>>Hello
>>>
>>>I have Windows XP with Windows Office 2003
>>>
>>>This morning, I received some returned mail from a server as the
>>>letter
>>>boxes were full
>>>
>>>The problem is that I didn't send these emails which apparently were
>>>sent by
>>>'Crazy Vente' followed by my email address in brackets (vente =
>>>'sales' in
>>>French and I live in France)
>>>
>>>The message came back and it is for a site that sells on line
>>>pharmaceuticals.
>>>
>>>I'm running a scan now.
>>>
>>>What do u think?
>>>
>>>Thanks in advance
>>><!--colorc--><!--/colorc-->
>>
>> Your computer is probably not a zombie but it's good to run a full
>> scan periodically.
>>
>> As Virus Guy described, it's not unusual for a legitimate email
>> address to be used as a return address for spam. Spammers will often
>> use your own email address as their return address to make it harder
>> for you to filter it.
>>
>> You can determine if your computer sent the emails by closely
>> checking
>> the headers of the bounced email to see what IP originated the email.
>> If it wasn't an IP address that your computer is/was assigned then
>> you
>> can be pretty sure it wasn't your computer that sent them.<!--colorc--><!--/colorc-->
>
> <!--colorc--><!--/colorc-->

 

"Dave Neve" <neve.dave@neuf.fr> wrote in message
news:OGpYQ0BJKHA.1252@TK2MSFTNGP04.phx.gbl...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> As for the 'joe job', I thought that someone could only use my address if
> they connect using it and to do that, they need the password etc.<!--colorc--><!--/colorc-->

Anyone can use your email address especially if you post it in a public
discussion group like this one.

 

In article <uZC3IYNJKHA.1376@TK2MSFTNGP02.phx.gbl>, "John" says...<!--coloro:blue--><span style="color:blue <!--/coloro-->
>
> "Dave Neve" <neve.dave@neuf.fr> wrote in message
> news:OGpYQ0BJKHA.1252@TK2MSFTNGP04.phx.gbl...<!--coloro:green--><span style="color:green <!--/coloro-->
> > As for the 'joe job', I thought that someone could only use my address if
> > they connect using it and to do that, they need the password etc.<!--colorc--><!--/colorc-->
>
> Anyone can use your email address especially if you post it in a public
> discussion group like this one. <!--colorc--><!--/colorc-->

Most providers have a clause about using another person's email
addresses in postings - it can actually get your account terminated.

If you create a non-routable email address you are fine, use one that
actually belongs to another person and you could be in trouble.

--
You can't trust your best friends, your five senses, only the little
voice inside you that most civilians don't even hear -- Listen to that.
Trust yourself.
spam999free@rrohio.com (remove 999 for proper email address)

 

Dave Neve wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro--><!--coloro:green--><span style="color:green <!--/coloro-->
>> As Virus Guy described, it's not unusual for a legitimate email
>> address to be used as a return address for spam. Spammers will often
>> use your own email address as their return address to make it harder
>> for you to filter it.<!--colorc--><!--/colorc--><!--colorc--><!--/colorc-->
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> As for the 'joe job', I thought that someone could only use
> my address if they connect using it and to do that, they
> need the password etc.<!--colorc--><!--/colorc-->

Just about anything in the headers can be forged. I routinely
get emails from my coworkers telling me where I can find cheap
Viagra.

--
Jordon

 

Leythos wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Most providers have a clause about using another person's
> email addresses in postings - it can actually get your
> account terminated.<!--colorc--><!--/colorc-->

Most providers give a rats ass what you do with your internet
connection. They don't care, and they don't want to know. They just
want you to keep paying them money once a month.

It's a joke to think that they'd terminate anyone's account for anything
so trivial as that.

 

Yes they will terminate and I have seen it numerous times

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

"Virus Guy" <Virus@Guy.com> wrote in message news:4A931707.744E08E@Guy.com...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Leythos wrote:
> <!--coloro:green--><span style="color:green <!--/coloro-->
>> Most providers have a clause about using another person's
>> email addresses in postings - it can actually get your
>> account terminated.<!--colorc--><!--/colorc-->
>
> Most providers give a rats ass what you do with your internet
> connection. They don't care, and they don't want to know. They just
> want you to keep paying them money once a month.
>
> It's a joke to think that they'd terminate anyone's account for anything
> so trivial as that.<!--colorc--><!--/colorc-->

 

In article <4A931707.744E08E@Guy.com>, Virus@Guy.com says...<!--coloro:blue--><span style="color:blue <!--/coloro-->
>
> Leythos wrote:
> <!--coloro:green--><span style="color:green <!--/coloro-->
> > Most providers have a clause about using another person's
> > email addresses in postings - it can actually get your
> > account terminated.<!--colorc--><!--/colorc-->
>
> Most providers give a rats ass what you do with your internet
> connection. They don't care, and they don't want to know. They just
> want you to keep paying them money once a month.
>
> It's a joke to think that they'd terminate anyone's account for anything
> so trivial as that.<!--colorc--><!--/colorc-->

It may be a Joke to you, but with just a few complaint to most
providers, they will terminate an account after just 1 warning.

--
You can't trust your best friends, your five senses, only the little
voice inside you that most civilians don't even hear -- Listen to that.
Trust yourself.
spam999free@rrohio.com (remove 999 for proper email address)

 

Leythos wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Unlike you, I appear to have experience with a LOT more providers
> than you do - you might take it as a learning lesson.<!--colorc--><!--/colorc-->

Unless you can point to objective material available on-line that
documents cases of ISP termination, then all you've posted so far is hot
air.

 

In article <4A95D9E3.ADCBBA4B@Guy.com>, Virus@Guy.com says...<!--coloro:blue--><span style="color:blue <!--/coloro-->
>
> Leythos wrote:
> <!--coloro:green--><span style="color:green <!--/coloro-->
> > Unlike you, I appear to have experience with a LOT more providers
> > than you do - you might take it as a learning lesson.<!--colorc--><!--/colorc-->
>
> Unless you can point to objective material available on-line that
> documents cases of ISP termination, then all you've posted so far is hot
> air.<!--colorc--><!--/colorc-->

LOL - Unless you can point to objective material available on-line that
disputes the TOS/AUP of the providers, all you're posting is hot air.



--
You can't trust your best friends, your five senses, only the little
voice inside you that most civilians don't even hear -- Listen to that.
Trust yourself.
spam999free@rrohio.com (remove 999 for proper email address)

 

Leythos wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro--><!--coloro:green--><span style="color:green <!--/coloro-->
> > Unless you can point to objective material available on-line that
> > documents cases of ISP termination, then all you've posted so
> > far is hot air.<!--colorc--><!--/colorc-->
>
> LOL - Unless you can point to objective material available on-line
> that disputes the TOS/AUP of the providers, all you're posting is
> hot air.<!--colorc--><!--/colorc-->

The onus is on you to show that ISP's do carry through on the
enforcement of their TOS/AUP. You seem reluctant, or unable, to do
that.

 

In article <4A9681C7.5197D1F8@Guy.com>, Virus@Guy.com says...<!--coloro:blue--><span style="color:blue <!--/coloro-->
>
> Leythos wrote:
> <!--coloro:green--><span style="color:green <!--/coloro--><!--coloro:darkred--><span style="color:darkred <!--/coloro-->
> > > Unless you can point to objective material available on-line that
> > > documents cases of ISP termination, then all you've posted so
> > > far is hot air.<!--colorc--><!--/colorc-->
> >
> > LOL - Unless you can point to objective material available on-line
> > that disputes the TOS/AUP of the providers, all you're posting is
> > hot air.<!--colorc--><!--/colorc-->
>
> The onus is on you to show that ISP's do carry through on the
> enforcement of their TOS/AUP. You seem reluctant, or unable, to do
> that.<!--colorc--><!--/colorc-->

LOL, sorry, you're wrong AGAIN Troll - the fact that almost every
PROVIDER, Usenet, ISP, etc... has a cause concerning faking email
addresses, well, that's more than enough proof for rational people.

--
You can't trust your best friends, your five senses, only the little
voice inside you that most civilians don't even hear -- Listen to that.
Trust yourself.
spam999free@rrohio.com (remove 999 for proper email address)

 

From: "Virus Guy" <Virus@Guy.com>

| Leythos wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro--><!--coloro:green--><span style="color:green <!--/coloro--><!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>> > Unless you can point to objective material available on-line that
>> > documents cases of ISP termination, then all you've posted so
>> > far is hot air.<!--colorc--><!--/colorc--><!--colorc--><!--/colorc--><!--colorc--><!--/colorc-->
<!--coloro:blue--><span style="color:blue <!--/coloro--><!--coloro:green--><span style="color:green <!--/coloro-->
>> LOL - Unless you can point to objective material available on-line
>> that disputes the TOS/AUP of the providers, all you're posting is
>> hot air.<!--colorc--><!--/colorc--><!--colorc--><!--/colorc-->

| The onus is on you to show that ISP's do carry through on the
| enforcement of their TOS/AUP. You seem reluctant, or unable, to do
| that.

You are aguing again ! I can't believe you get into arguments like you do.

There is lots of anecdotal information that some ISPs/NSPs cancel accounts for using
someone else's email address. Not all do but some do. However you will NOT find direct
evindence to that. The lack of direct evidence does not change the fact that a given ISP
or NSP will summarily cancel an account for using another person's email address.

--
Dave

Multi-AV -

 

In article <e1Ybwj1JKHA.1252@TK2MSFTNGP04.phx.gbl>,
DLipman~nospam~@Verizon.Net says...<!--coloro:blue--><span style="color:blue <!--/coloro-->
>
> From: "Virus Guy" <Virus@Guy.com>
>
> | Leythos wrote:
> <!--coloro:green--><span style="color:green <!--/coloro--><!--coloro:darkred--><span style="color:darkred <!--/coloro-->
> >> > Unless you can point to objective material available on-line that
> >> > documents cases of ISP termination, then all you've posted so
> >> > far is hot air.<!--colorc--><!--/colorc--><!--colorc--><!--/colorc-->
> <!--coloro:green--><span style="color:green <!--/coloro--><!--coloro:darkred--><span style="color:darkred <!--/coloro-->
> >> LOL - Unless you can point to objective material available on-line
> >> that disputes the TOS/AUP of the providers, all you're posting is
> >> hot air.<!--colorc--><!--/colorc--><!--colorc--><!--/colorc-->
>
> | The onus is on you to show that ISP's do carry through on the
> | enforcement of their TOS/AUP. You seem reluctant, or unable, to do
> | that.
>
> You are aguing again ! I can't believe you get into arguments like you do.
>
> There is lots of anecdotal information that some ISPs/NSPs cancel accounts for using
> someone else's email address. Not all do but some do. However you will NOT find direct
> evindence to that. The lack of direct evidence does not change the fact that a given ISP
> or NSP will summarily cancel an account for using another person's email address.<!--colorc--><!--/colorc-->

Actually, PCBUTTS1 purchased an account from my Usenet provider and
started forging post as me, using my email address - I submitted the
headers and his account was terminated in hours of my complaint. Butts
was even stupid enough to blog about it, exposing himself and that his
account was terminated.

--
You can't trust your best friends, your five senses, only the little
voice inside you that most civilians don't even hear -- Listen to that.
Trust yourself.
spam999free@rrohio.com (remove 999 for proper email address)