Multiple Infected EMails

[Hubert D. Rabon]

Greetings. Last week I successfully reinstalled my
Windows 2000, as well as Office and other software,
including up-to-date Norton. Since then I have been
bombarded with infected EMails, up to 60 per day. The
Norton is working in Outlook as it should, obviously, but
the numbers coming-in are incredible and very bothersome.

Examples read as follows:


This is the qmail program

I'm sorry I wasn't able to deliver your message to the
following addresses:



Undeliverable mail to (e-mail address removed)


AND the ones that look like Microsoft security notices:


ALERT!!!
This e-mail in its original form contained one or more
attached files that were infected with a virus or worm, or
contained another type of security threat.

The following attachments were infected and have been
repaired:
No attachments are in this category.

The following attachments were deleted due to an inability
to clean them:
1. INSTALLER854.exe: W32.Swen.A@mm

The Following attachments were not delivered due to
inbound mail policy violations:
No attachments are in this category.


Road Runner does not contact the sender of the infected
attachment(s) in the event that they were not actually
sent from the indicated party.

Please contact the sender directly to alert them of their
issue with infected files if you wish to do so.

For more information on Road Runner's virus filtering
initiative, visit our Help & Member Services pages at
http://help.rr.com, or the virus filtering information
page directly at http://help.rr.com/faqs/e_mgsp.html.

------------ Original message text follows ------------

Microsoft All Products | Support | Search |
Microsoft.com Guide
Microsoft Home


Microsoft Partner

this is the latest version of security update,
the "September 2003, Cumulative Patch" update which
resolves all known security vulnerabilities affecting MS
Internet Explorer, MS Outlook and MS Outlook Express as
well as three new vulnerabilities. Install now to maintain
the security of your computer from these vulnerabilities,
the most serious of which could allow an attacker to run
code on your system. This update includes the
functionality of all previously released patches.


System requirements Windows 95/98/Me/2000/NT/XP
This update applies to MS Internet Explorer, version
4.01 and later
MS Outlook, version 8.00 and later
MS Outlook Express, version 4.01 and later
Recommendation Customers should install the patch at the
earliest opportunity.
How to install Run attached file. Choose Yes on displayed
dialog box.
How to use You don't need to do anything after installing
this item.

Microsoft Product Support Services and Knowledge Base
articles can be found on the Microsoft Technical Support
web site. For security-related information about Microsoft
products, please visit the Microsoft Security Advisor web
site, or Contact Us.

Thank you for using Microsoft products.

Please do not reply to this message. It was sent from an
unmonitored e-mail address and we are unable to respond to
any replies.

-----------------------------------------------------------
---------------------
The names of the actual companies and products mentioned
herein are the trademarks of their respective owners.



I never had these before. Where are they coming from, and
why? How do I made them stop?

Thank you for your help,


Hubert D. Rabon

 

[Veronica Loell]

This is the effect of the worm Swen.A
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]
It harvests email-adresses from the infected computer and sends theese
emails. The only way for it to stop is that the infected computers get
fixed.

I have designed a filter for Magic mail monitor 3 that successfully
identifies theese messages. MMM3 does not actually download the emails,
just the headers and you can set it to automatically delete the filtered
emails if you wish, the default in the filter is to only highlight them.
See http://nakawe.sf.net/MMM3 for details.

- Veronica Loell

Hubert D. Rabon wrote / skrev:

 

[Apan]

I am having exactly the same problem. I have been at
least 30/40 per day. Read somewhere in Microsoft FAW how
to identify the addresses from where these mails are
originated. I searched again. But, I could not find the
information. I am not sure how I go to that info. I will
really apprecaite if Microsoft Tech people guide us to the
info.

 

[Veronica Loell]

Apan wrote / skrev:

I am having exactly the same problem. I have been at
least 30/40 per day. Read somewhere in Microsoft FAW how
to identify the addresses from where these mails are
originated. I searched again. But, I could not find the
information. I am not sure how I go to that info. I will
really apprecaite if Microsoft Tech people guide us to the
info.

This is the effect of someone else being infected with the SWEN-virus.
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]
You can look at the complete header of the message to see where they are
coming from.
The email created by the virus may have a correct Return-to adress. Look
for "Return-Path:" in the complete header. You can also look for the
last "Received:" and look up the IP-adress given there to find out what
email-SMPT-server it was sent through.
Neither of theese are 100% sure, but they may help you get started.

See http://nakawe.sf.net/MMM3 for a way to automatically identify and
remove theese emails before you download them onto your computer.

- Veronica Loell

 

[Guest]

Same happened to me last week. I now use MAILWASHER really
takes out the hassle. Check out www.mailwasher.net