SoBig and a few other viri/worms floating around, do indeed infect machines via email, and begin spewing garbage email out. I'd bet money your machine isn't infected. Instead what you're seeing is one of those infected machines somehow catching wind of your e-mail address, either in the infected user's address book, or in any plaintext file on their infected system. The worm uses that along with other addresses it harvests off the machine as the 'From:' address for the crap it spews. So, when it sends mail out that a remote system, say AOL blocks and bounces, they bounce it back to the 'From:' (you) instead of the machine that actually generated the crap. A quick look at the bounces and headers will reveal that the mail is or is not orriginating from your machine.
Joshua Coombs ISP Network Monkey Getting Tired of Worms... ----- Original Message ----- From: "Jason White" <[EMAIL PROTECTED]> To: "Compact Macs" <[EMAIL PROTECTED]> Sent: Wednesday, August 27, 2003 3:45 PM Subject: Stay Back! My (?) SE/30 is Ill! > I hope my machine isn't really ill, but it may be: > > A few days ago, I received an email from AOL that said a email address I > sent something to was unknown. I didn't think anything of it, as alot of > the addresses I reply to (on this and other lists) are unknown to me. > > This morning I received two more messages with different emails, but also > @AOL. So I went through my sent mail, and didn't see any of the three in > there. Then I went through and searched for them (one at a time) through > all my saved messages. Nothing there either, except for the three > messages AOL sent me with these bogus email addresses ([EMAIL PROTECTED], > [EMAIL PROTECTED], can't recall the third) > > After that I called my ISP, and as usual, they told me to update my > Windows security files. Naturally, that did not work :) So I got to talk > to one of two guys that I've run across at their support desk that know > something about computers (Mac or PC, anyone can read a prompter on a > screen I guess), and he insists a virus. Even I after I explained that it > would be pretty silly to write a virus that would run on a 68030 chip. > > So here comes my question. He said that this virus is HTML based (which I > don't believe Claris Emailer 1.x recognizes) and that it doesn't matter > which OS, or mail, or browser you use, it can still get in. Is this in > any way, shape, or form accurate? <---- There's the question <------ > > Anyhow, he recommended I update to the latest version of OS X, and run a > virus check program on my machine with an up to date set of definitions. > So, I downloaded the latest set for Virex, and checked, and aside from > finding a few alias's with no original, my HD came up clean (duh). But I > refuse to update this SE/30 to X, I like 7.1 too much :) > > Anyone have any thoughts on this, or is anyone having the same thing > happening to them right now? > > Thanks, > > > > > J White > > Buy American > S.O.S. Save Our Steel > > > -- > Compact Macs is sponsored by <http://lowendmac.com/>. > > Support Low End Mac <http://lowendmac.com/lists/support.html> > > Compact Macs list info: <http://lowendmac.com/lists/compact.shtml> > --> AOL users, remove "mailto:"; > Send list messages to: <mailto:[EMAIL PROTECTED]> > To unsubscribe, email: <mailto:[EMAIL PROTECTED]> > For digest mode, email: <mailto:[EMAIL PROTECTED]> > Subscription questions: <mailto:[EMAIL PROTECTED]> > Archive:<http://www.mail-archive.com/compact.macs%40mail.maclaunch.c om/> > > > --------------------------------------------------------------- > >The Think Different Store > http://www.ThinkDifferentStore.com > --------------------------------------------------------------- > > -- Compact Macs is sponsored by <http://lowendmac.com/>. Support Low End Mac <http://lowendmac.com/lists/support.html> Compact Macs list info: <http://lowendmac.com/lists/compact.shtml> --> AOL users, remove "mailto:"; Send list messages to: <mailto:[EMAIL PROTECTED]> To unsubscribe, email: <mailto:[EMAIL PROTECTED]> For digest mode, email: <mailto:[EMAIL PROTECTED]> Subscription questions: <mailto:[EMAIL PROTECTED]> Archive:<http://www.mail-archive.com/compact.macs%40mail.maclaunch.com/> --------------------------------------------------------------- >The Think Different Store http://www.ThinkDifferentStore.com ---------------------------------------------------------------
