UNSOLVED

thebigrombalski

updated

20 years ago

0

4920

April 9th, 2006 01:00

E-mail spoofing...

i think my e-mail has been spoofed...it looks as if my user account is being used to send spam mail packages with the "mydoom" virus...for the past few days i have been getting atleast 12 infected e-mails bounced back to my account...any ideas how to stop this? 
  • ky331

    5 Journeyman

    15622 Posts

    45048 Points

    350

    0

    Posted April 9th, 2006 11:00

    While it's certainly a possibility that YOUR computer is infected, and sending out the spam messages, be advised that it's also possible that this problem does NOT reside in your machine, but rather, the problem may reside completely in someone else's machine (a friend, colleague, or acquaintance of yours) who "knows" your e-mail address.   Because one of the features of these e-spamming viruses is to FORGE e-mails from the infected machine, using names it finds in its address book .   If that's what happened... if the problem is on an acquaintance's machine [and not yours], then no matter what you do to try to clean YOUR machine won't help.... the e-mails will continue until that acquaintance gets his/her machine cleaned.
  • 350

    0

    Posted April 9th, 2006 16:00

    I'd like to assume it's not my computer that is infected (however it could be)...i posted a few days ago, and you were all kind enough to give me suggestions...such as stinger, HJT, sigver, my own McAfee software, and nothing shows up on any of the scans...is there any way for me to track down the IP address of the infected e-mails?
  • ky331

    5 Journeyman

    15622 Posts

    45048 Points

    350

    0

    Posted April 9th, 2006 22:00

    i don't know enough about the possibility of tracking the IP address... perhaps someone else does.

    if you are sure it's "mydoom", then I would suggest you download and run two or three of the dedicated "mydoom" removal tools.

    you said you've already run stinger (McAfee AVERT Stinger) http://vil.nai.com/vil/stinger/

    if you haven't already tried these, I would also suggest you try the Symantec mydoom removal tool  http://securityresponse.symantec.com/avcenter/venc/data/w32.mydoom@mm.removal.tool.html

    and the microsoft windows malicious software removal tool (require winXP or win2000) http://www.microsoft.com/downloads/details.aspx?FamilyID=ad724ae0-e72d-4f54-9ab3-75b8eb148356&displaylang=en

    if all three tools agree that you're clean, then you can reasonably conclude the mydoom problem is on an acquaintances computer rather than yours [or else it might be something other than "mydoom"]