E-Mail Virus question?

1

Ok here is the deal.
I open Outlook and it checks Hotmail and finds this.

This is an automatically generated Delivery Status Notification.

Delivery to the following recipients failed.

   [[u][color=#0000ff][email protected][/color][/u]](묌ׄ紿Ȣ)

Now I have never seen this e-mail address before and know I didn’t send it, so I look at the attachment for more details.

A virus (WORM_NETSKY.C) was detected in the file (image.txt.com). Action taken = remove
-

be mad?

The attachment (image.txt.com) was infected with a virus and removed.

Well I know I never sent any message “be mad?” to anyone, and I have never seen that e-mail address before.
So I check the properties of the E-mail.

Received: from mail.nrgflinders.com.au ([10.143.0.116]) by flnpkm003.flinders with Microsoft SMTPSVC(5.0.2195.5329);
Mon, 5 Jul 2004 19:49:02 +0930
Received: from nrgflinders.com.au ([203.220.103.112]unverified) by mail.nrgflinders.com.au with InterScan Messaging Security Suite; Mon, 05 Jul 2004 19:48:24 +0930
From: [email protected]
To: [email protected]
Subject: warning
Date: Mon, 5 Jul 2004 19:48:07 +0930
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary=“----=_NextPart_000_0008_0000216D.00006F2E”
X-Priority: 3
X-MSMail-Priority: Normal
Return-Path: ----ME----@hotmail.com
Message-ID: <[email protected]>
X-OriginalArrivalTime: 05 Jul 2004 10:19:02.0641 (UTC) FILETIME=[7E84BE10:01C46279]

(----ME---- put in place of my real address by me.)

So it shows that I sent this message on Monday and it came back to me. Now I know I didn’t send it so my first guess is that I have a virus and it sent itself to everyone in my address book.

1. It didn’t come back from anyone else.
2. That e-mail address is not in my address book.
3. I did a virus scan last night and found nothing.

[color=red]SO my question is whats going on here ?[/color]

2

If you have an email address that is something common like johnsmith[at]hotmail.com, chances are a a random header was constructed by the virus, and when it bounced the email returned to you. Another scenario might be someone you know has the virus, and it builds headers using names in the address book, then sends them out to the rest of the addresses. Try using one of the online virus scanners to scan your computer, they take forever, but, they aren’t as vulnerable to an already resident virus.

3

Thanks for the response.

—ME— = the AKA under The_Vulcan, so I doubt they would generate something like that.

As for someone else with my address in their address book…
I know I can send a E-mail and have the From: line show whatever I want, but if you go into properties it still shows where it really came from…

I guess they have better ways of doing it to get around this.

4

Most of the email worms use their own email engine and actually construct a full header, not just the, to from subject, fill in the blanks type thing.