W32/Sobig.f@MM virus

[Celia Mitschelen]

I have McAfee Pro 7 with the latest data file and it gives me a clean report
so I really feel my computer is clean but I still get bounced mail. I know
that it is most likely some unknown infected computer whose address book I
am in. Still, it makes me a bit nervous. Is it possible for my computer can
send out e-mail message without it showing up in the sent mail folder? I
KNOW at least some of the yesterday's returns could not have come from my
computer as it was not turned on all morning which was the time showing as
having been sent.

I just need a little reassurance or a good jog if I am not being concerned
enough about the W32/Sobig.f@MM virus which several claimed I sent.

Celia

 

[FromTheRafters]

I have McAfee Pro 7 with the latest data file and it gives me a clean report
so I really feel my computer is clean but I still get bounced mail. I know
that it is most likely some unknown infected computer whose address book I
am in. Still, it makes me a bit nervous.

Yes, but you know the score....

Is it possible for my computer can
send out e-mail message without it showing up in the sent mail folder?

Yes, it is entirely possible.
....but probably *not* what is happening to you.

I
KNOW at least some of the yesterday's returns could not have come from my
computer as it was not turned on all morning which was the time showing as
having been sent.

More evidence that you first assumption is true.

I just need a little reassurance or a good jog if I am not being concerned
enough about the W32/Sobig.f@MM virus which several claimed I sent.

It is hard to be sure of anything in this uncertain world in which
we live.

...but this is a normal consequence of Sobig.f, and you did say
that you scanned with up-to-date AV and came up clean.
This should have reassured you a little.

 

[Celia Mitschelen]

----- Original Message -----
From: "FromTheRafters" <[email protected]>
Newsgroups: alt.comp.anti-virus
Sent: Tuesday, August 26, 2003 2:39 PM
Subject: Re: W32/Sobig.f@MM virus

Yes, but you know the score....


Yes, it is entirely possible.
...but probably *not* what is happening to you.


More evidence that you first assumption is true.


It is hard to be sure of anything in this uncertain world in which
we live.

..but this is a normal consequence of Sobig.f, and you did say
that you scanned with up-to-date AV and came up clean.
This should have reassured you a little.

Thank you. I was hoping not having these messages in my 'sent mail' folder
was a good sign but I'll take what I can get. <sigh>

Celia

 

[FromTheRafters]

Thank you. I was hoping not having these messages in my 'sent mail' folder
was a good sign but I'll take what I can get. <sigh>

Many (probably most) of the modern mass mailing worms
use their own SMTP engine. This means that not only don't
they use the sent items folder, I don't even think that they
require that an e-mail program exist on the machine (except
possibly to receive the worm in the first place).

 

[terrypin]

Hi Celia;

I'm getting a similar problem; in as much as one of my hotmail accounts has
been used to send the Sobig.F virus, and I'm receiving about three messages
an hour that have been "bounced". I was on holiday last week, when most of
these started to crop up, so my computer was off all week, and I know I
can't be the guilty party. They all seem to be bouncing back from domains in
the former eastern bloc countries, by the way.

A while ago, I bit the bullet and paid for ZoneAlarm Pro, version 4. As far
as I can see, it has exactly one advantage over the free version - it won't
let programs send mail without asking my approval first. So, in the event
that I get caught out - and I update my AV twice daily, and I have two AV
progs running at the same time, but it "will" happen, sooner or later - then
at least I'm not going to bug all my friends (and acquaintances) by sending
the virus to them.


Timbo

 

[John Coutts]

Many (not all) bounced messages include the header of the original message, or
at least some description of the original source such as: