Do I have a virus?

[Steve 4454]

I have XP Professional for an OS. I have updated the OS and have all the
latest patches, service packs, etc. I have McAfee and I update it several
times a week. When I run McAfee, it tells me I have no viruses.

Lately I have been getting my share of crapola from "Microsoft" offering me
the latest patch. These are deleted routinely.

What has me bothered is some emails I am getting. I will reprint one below:

Hi.
This is the qmail program
I'm sorry to have to inform you that I wasn't able to deliver your message
to the following addresses:
Undelivered to (e-mail address removed)
Message follows:


Is my computer sending out emails that I am unaware of? Why am I getting
this message that something I never sent is undeliverable? I thought I was
taking all the right precautions but now I am not so sure.

Any idea on what is going on with these "returned emails"?

 

[Roy]

I am getting the same sort of mails as you. I think it is part of the same
crap as the microsft mails. They all come with an attachment. I delete them
along with all the other rubbish from the bogus microsft site

 

[Rick \Nutcase\ Rogers]

Hi Steve,

Ignore those as well, they are the result of manifestations of the virus
being intercepted by some av programs that send out warnings to other
recipients. Others are the result of your email address being used as the
"from" address by the bug.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x

Associate Expert - WinXP - Expert Zone

 

[Steve 4454]

Thank you both for putting my mind at ease!!!

I am getting the same sort of mails as you. I think it is part of the same
crap as the microsft mails. They all come with an attachment. I delete them
along with all the other rubbish from the bogus microsft site

 

[GSV Three Minds in a Can]

Bitstring <BFGfb.685757$uu5.112151@sccrnsc04>, from the wonderful person

Any idea on what is going on with these "returned emails"?

Each SWEN.A infected PC typically sends you =two= messages to try to
infect you. Message 'a' is disguised as an MS patch, and requires you to
suspend your intelligence and install it. Message 'b' is a fake
'bounce', which has an executable mis-labelled as a .wav, and relies on
your having an old, un-patched version of Outlook Express, which will
open it in the preview pane and run it (The OS being too clever for its
own good detects that it isn't a .wav, but rather a ,scr, .exe. or .pif,
and executes it). Of course, if you're really stupid you can also open
the attachment manually, to the same bad effect.

So .. someone has an infected PC with your email address on it somewhere
(although SWEN also harvest from newsgroups, including this one). If
your AV is up-to-date and says you aren't infected, then you aren't
infected .. although having hundreds of 150KB emails arriving every day
is almost as annoying as if you were. 8<,

 

[T.C.]

Also, my ISP, like many others, auto-scans for viruses, and sends a warning
message for each message that it has intercepted that has a worm/virus. The
message says something like "you've received a message from
(e-mail address removed) containing a virus etc." If the infected message was
from a spammer, I ignore it. If the infected message was sent by someone I
know, who is unaware that their system is infected with a worm/virus that's
auto-sending to addresses in their address book, I inform them.

 

[Bruce Chambers]

Greetings --

What you received is either a very common malicious hoax or the
output of a computer infected by one of several wide-spread, mass
emailing worms. The most widely-known are:

W32.Swen.A_mm
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

W32.Dumaru_mm
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

W32.Gibe_mm
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

How to Tell If a Microsoft Security-Related Message Is Genuine
http://www.microsoft.com/security/antivirus/authenticate_mail.asp

Microsoft never has, does not currently, and never will email
unsolicited security patches. At the most, if, and only if, you
subscribe to their security notification newsletter, they will send
you an email informing you that a new patch is available for
downloading.

Microsoft Policies on Software Distribution
http://www.microsoft.com/technet/treeview/?url=/technet/security/policy/swdist.asp

Information on Bogus Microsoft Security Bulletin Emails
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/news/patch_hoax.asp

How to Tell If a Microsoft Security-Related Message Is Genuine
http://www.microsoft.com/security/antivirus/authenticate_mail.asp

Any and all legitimate patches and updates are readily available
at http://windowsupdate.microsoft.com/. (Notice that this is the true
URL, rather than the bogus one that may have been contained in the
email you received.) Any messages that point to any other source(s) or
claim to have the patch attached are bogus.

You're receiving these emails because your email address is in
the address book of someone infected with a worm, and/or because you
posted your real email address somewhere on-line, either in a forum
accessible to the public and spambots, such as Usenet, or on an
untrustworthy web site that subsequently sold your address as part of
a mailing list. One thing you can do is notify _everyone_ with whom
you've ever corresponded via email that one or more of them may be
infected with a mass emailing worm, and should take the appropriate
steps.

There's probably no way of blocking all of the bogus messages, but
you can greatly reduce the number you get by creating a rule, based
upon the most commonly used subject lines, to delete the emails from
the server without ever downloading them.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Alex Nichol]

Hi.
This is the qmail program
I'm sorry to have to inform you that I wasn't able to deliver your message
to the following addresses:
Undelivered to (e-mail address removed)
Message follows:


Is my computer sending out emails that I am unaware of? Why am I getting
this message that something I never sent is undeliverable? I thought I was
taking all the right precautions but now I am not so sure.

This sounds like another of the ways in which the Swen virus tries to
persuade you to install itself. It sends an apparent mail failure, with
an attachment, purportedly returned mail, that is the virus

 

[John]

Hi.
This is the qmail program
I'm sorry to have to inform you that I wasn't able to deliver your message
to the following addresses:
Undelivered to (e-mail address removed)
Message follows:


Is my computer sending out emails that I am unaware of? Why am I getting
this message that something I never sent is undeliverable? I thought I was
taking all the right precautions but now I am not so sure.

This sounds like another of the ways in which the Swen virus tries to
persuade you to install itself. It sends an apparent mail failure, with
an attachment, purportedly returned mail, that is the virus

--
Alex Nichol MS MVP (Windows Technologies)
Bournemouth, U.K. (e-mail address removed)


More correctly Steve,

You were sent this email from someone who has the virus.
Your email address either came from the person with the virus, or was
gleaned from a newsgroup.
(Notice; I'm not using my real address)
If you try to run the attachment, you will also contract the virus.
Just delete it, and any others.

John