Why is my email program is sending out viruses?

Technical Questions & Discussions about Computers, IT & electronics.
Post Reply
lee
udonmap.com
Posts: 7278
Joined: July 3, 2005, 5:51 pm
Location: Udon Thani
Contact:

Why is my email program is sending out viruses?

Post by lee » October 25, 2005, 2:24 pm

Just recently I've noticed that when I open Microsoft Outlook on my computer it automatically sends emails without me doing anything. I didn't really think to much about it until today when I was sent this email: V I R U S A L E R T

Our viruschecker found the

W32/Netsky.ab@MM

virus in your email to the following recipient:

-> <[email protected]>

Delivery of the email was stopped!

Please check your system for viruses,
or ask your system administrator to do so.

I never sent this email and this email doesn't reside in my sent box folder. I have all the usual virus software programs but they haven't detected anything.
This happened to me before but I've forgotten how I removed it. I really don't want to be spreading viruses all over the net.

Any ideas anyone?

Lee



User avatar
BobHelm
udonmap.com
Posts: 18411
Joined: September 7, 2005, 11:58 pm
Location: Udon Thani

Post by BobHelm » October 25, 2005, 2:50 pm

Lee this is a pretty old worm so I am surprised that your virus checker didn't get rid of it, unless you have a really new variant of it.
Here is Sophus advice of how to remove it, never had to do it myself (thank God) but they are an extremely well respected organisation.

http://www.sophos.com/virusinfo/analyse ... skyab.html

User avatar
BangkokButcher
udonmap.com
Posts: 2690
Joined: July 4, 2005, 9:06 pm
Contact:

Post by BangkokButcher » October 25, 2005, 11:40 pm

You beat me too it Bob :lol:

User avatar
BobHelm
udonmap.com
Posts: 18411
Joined: September 7, 2005, 11:58 pm
Location: Udon Thani

Post by BobHelm » October 26, 2005, 12:08 am

Aah,,, an EXTREMELY slow day at work today Sean... :D Will just be glad when they finally say "thanks, Bob, here is the cheque"...

User avatar
banpaeng
udonmap.com
Posts: 2644
Joined: July 4, 2005, 9:20 pm

Post by banpaeng » October 26, 2005, 12:12 am

Bob, I had to laugh. One of the things I am waiting for is after my back gets ok and am released for work, I have to go work for two hours. They are going to make me come back to end our mutual agreed relationship. That means Thailand Here I come!!!!!!!!!!!!

User avatar
BobHelm
udonmap.com
Posts: 18411
Joined: September 7, 2005, 11:58 pm
Location: Udon Thani

Post by BobHelm » October 26, 2005, 12:19 am

Great news BP, so pleased for you (Can afford to be as I can almost see that light at the end of my tunnel too - and it certainly ain't a train this time... :D ) those should be the best two hours of your working life!!!

User avatar
banpaeng
udonmap.com
Posts: 2644
Joined: July 4, 2005, 9:20 pm

Post by banpaeng » October 26, 2005, 12:23 am

Never quite thought of it that way Bob. Guess you are right. :D

lee
udonmap.com
Posts: 7278
Joined: July 3, 2005, 5:51 pm
Location: Udon Thani
Contact:

Post by lee » October 26, 2005, 7:36 am

Lee this is a pretty old worm so I am surprised that your virus checker didn't get rid of it, unless you have a really new variant of it.
Here is Sophus advice of how to remove it, never had to do it myself (thank God) but they are an extremely well respected organisation.

http://www.sophos.com/virusinfo/analyse ... skyab.html
Thanks for the information Bob, I will check out that site and see if I can get rid of this dam thing.

Regards, Lee

lee
udonmap.com
Posts: 7278
Joined: July 3, 2005, 5:51 pm
Location: Udon Thani
Contact:

Post by lee » October 28, 2005, 9:03 am

Hi Bob, I followed the instructions on the website link you gave me but I was unable to located the virus. It tells me to look within the registery files but even after doing a search I am unable to locate it. Maybe it has a different name?

Anyway I do appreciate you sending me the link because it looks like a very helpful site.

I guess it's back to the drawing board.

Lee

PopsIcafe
Udonmap Sponsor
Posts: 1106
Joined: July 4, 2005, 4:21 pm
Location: Bannon Udon Thani
Contact:

Post by PopsIcafe » October 28, 2005, 10:56 am

Lee have you checked you options settings in outlook to make sure that you don't have it set to send email when you log on?

Pop's :pirate:

User avatar
BobHelm
udonmap.com
Posts: 18411
Joined: September 7, 2005, 11:58 pm
Location: Udon Thani

Post by BobHelm » October 28, 2005, 2:50 pm

Lee, if you can't find the file mentioned on the site then I would very much doubt if you have the Netsky virus. About the only thing that you can do is try this site and run stinger, that will certainly tell you if you have a virus - if that doesn't register anything then you are safe, well from viruses anyway... :D
http://vil.nai.com/vil/stinger/

lee
udonmap.com
Posts: 7278
Joined: July 3, 2005, 5:51 pm
Location: Udon Thani
Contact:

Post by lee » November 2, 2005, 11:40 am

My email program is still sending out viruses, looks like a different one this time:

Code: Select all

<[email protected]>: host xxxxxxxx said: xxxxxxxxx Message content
    rejected, id=04876-02 - VIRUS: Worm.SomeFool.P, Exploit.HTML.IFrame (in
    reply to end of DATA command)
I ran Stinger which didn't detect any viruses, I also ran my own Mcaffee virus program which failed to detect anything. Spyware Doctor didn't find anything too.

I have also changed the setting in Outlook to not send automatically as Cliff pointed out. and I have also checked the registry files but I'm unable to locate anything unusual.

Any ideas anyone?

Thanks, Lee

User avatar
BobHelm
udonmap.com
Posts: 18411
Joined: September 7, 2005, 11:58 pm
Location: Udon Thani

Post by BobHelm » November 2, 2005, 3:33 pm

Lee, it is certainly the same virus as before - Netsky, see link below for details
http://www.viruslist.com/en/viruses/enc ... usid=22760
However, expert exchange has exactly the same question from a poster as you, but you need to subscribe to see the answer!! (Pay to subscribe $10 a month) :cry:
http://www.experts-exchange.com/Securit ... 77080.html
BUT...if you look at this link then it is likely that you do not have the virus at all, but someone who has your e-mail address does!!
http://scott.yang.id.au/2004/03/quarantined/
If you have an up to date virus checker & have run stinger then I think it is highly unlikely that you have this virus. Perhaps you should send the stinger link to everyone in your address book & get them to check their pcs. :D

lee
udonmap.com
Posts: 7278
Joined: July 3, 2005, 5:51 pm
Location: Udon Thani
Contact:

Post by lee » November 3, 2005, 1:34 pm

Thanks Bob, your help is much appreciated. :D

I will send an email out to all my contacts, should be fun because I have hundreds.

Regards,

Lee

rufus
udonmap.com
Posts: 607
Joined: November 5, 2005, 12:37 pm

Post by rufus » November 5, 2005, 6:23 pm

Netsky as has been mentioned has been around a long time. Try loggong into the Norton site. They have an on line program which will check to see if you have a virus. Certainly Netsky acts as you have been describing.

Post Reply

Return to “Computers, IT & Electronics”