Emails always sent to the same persons, after receiving a virus

[Vince]

Hi,

I will explain my problem which seems to be very curious.

When I receive an email with a virus, McAfee detects it and puts it in
the 'Quarantine' folder of Outlook XP. However, Outlook tries to send an
email as below (from the sent-box folder) indicating I had a virus :

Object : Virus Alert

Attachment file : your_file.zlo
Virus name: W32/Netsky.d@MM
Action taken : Unable to Clean...

Attachment file : your_file.zlo
Virus name: W32/Netsky.d@MM
Secondary Action taken : Moved...

But, I would like to know why Outlook sends each time such an email to
the same 2 persons (whatever the email, without links with these 2
persons) which I don't know, which are not in my adress book of Outlook
and from which I never received email (I do believe).

For the moment, my smtp is not configured, but I would like to resolve
this problem (the fact that I always send an email to these 2 persons)
before doing it.

Thank you for your help.

Vince

 

[Diane Poremsky [MVP]]

You are either infected or Mcafee is sending a warning message in response
to the incoming messages. Check Mcafee's options.

--
Diane Poremsky [MVP - Outlook]
Author, Teach Yourself Outlook 2003 in 24 Hours
Coauthor, OneNote 2003 for Windows (Visual QuickStart Guide)
Author, Google and Other Search Engines (Visual QuickStart Guide)



Join OneNote Tips mailing list: http://www.onenote-tips.net/

Vote for your favorite Outlook and Exchange utilities in the
Slipstick Ratings Raffle at http://www.slipstick.com/contest/

 

[Vince]

You are either infected or Mcafee is sending a warning message in response
to the incoming messages. Check Mcafee's options.

I check the log file of McAfee. So, it seems that McAfee used Outlook XP
to send a warning message, as you said.

However, I don't know why I always send it to the same 2 persons. I will
run McAfee, but I am not sure that I am infected. Moreover, I have this
problem since several months.

If you have any udea. Thanks by advance.

Vince

 

[Diane Poremsky [MVP]]

probably because the viruses come from the same addresses (usually faked)...
jjjones sends a ton to me.

--
Diane Poremsky [MVP - Outlook]
Author, Teach Yourself Outlook 2003 in 24 Hours
Coauthor, OneNote 2003 for Windows (Visual QuickStart Guide)
Author, Google and Other Search Engines (Visual QuickStart Guide)



Join OneNote Tips mailing list: http://www.onenote-tips.net/

Vote for your favorite Outlook and Exchange utilities in the
Slipstick Ratings Raffle at http://www.slipstick.com/contest/

 

[Vince]

probably because the viruses come from the same addresses (usually faked)...
jjjones sends a ton to me.

To sum up, when I receive an email with a virus, McAfee detects it and
Outlook Xp sends an email to advert that I received a virus. In theory,
the receiver should be the person who send me the virus, or a person in
my adress book if I am infected (seems to be not the case, no virus
found by McAfee with a recent update), but, not to the same 2 persons.

Wait, I think you are right Diane, I forget to look at this. The emails
with viruses are always send via the same IP address. Since the name of
the sender is different, I think that the PC at this particular IP
address is a gateway to transmit viruses.

But, I still do not understand why my Outlook always tries to send
alerts to the 2 same persons that I do not know. Is there someone which
could explain it?

Thanks.

Vince

 

[Vince]

To sum up, when I receive an email with a virus, McAfee detects it and
Outlook Xp sends an email to advert that I received a virus. In theory,
the receiver should be the person who send me the virus, or a person in
my adress book if I am infected (seems to be not the case, no virus
found by McAfee with a recent update), but, not to the same 2 persons.

Wait, I think you are right Diane, I forget to look at this. The emails
with viruses are always send via the same IP address. Since the name of
the sender is different, I think that the PC at this particular IP
address is a gateway to transmit viruses.

But, I still do not understand why my Outlook always tries to send
alerts to the 2 same persons that I do not know. Is there someone which
could explain it?

Thanks.

Vince

A little precision: In my virus email, I have actually 3-4 groups of IP
address which seems to be gateway. However, whatever the sender (IP
address), I always always send my alert email to the same 2 persons.
Strange, in'it?

Vince

 

[Diane Poremsky [MVP]]

A little precision: In my virus email, I have actually 3-4 groups of IP

address which seems to be gateway. However, whatever the sender (IP
address), I always always send my alert email to the same 2 persons.
Strange, in'it?

Yes it is, unless they are abuse addresses for the IPs.

 

[Vince]

Yes it is, unless they are abuse addresses for the IPs.

This problem is very strange. Where Outlook can find the same 2 persons
when it sends a virus alert because I reveive a virus from someone, not
always the same person or IP?

If someone has an explication, it could be very useful and interesting.

Vince

 

[Diane Poremsky [MVP]]

is the item put in your sent folder? or take it out of the outbox before it
sends and send one to me at drcp @ poremsky.com

--

 

[Vince]

Diane,

is the item put in your sent folder? or take it out of the outbox before it
sends and send one to me at drcp @ poremsky.com

When I receive an email with a virus, I have for example:

- In my in-box: 'MCAFEE E-MAIL SCAN ALERT!~RE: HI' indicating that I
have such an email
- In quarantine, the original email with the virus
- In sent-box (but not sent-mail, or sthg like that, I have a French
version), Outlook tries to send an email 'Virus Alert' to 2 persons,
each time the same ones.

I bounce to you an example of such email.

What's happened?

Vince

 

[Vince]

Diane,

I bounce to you an example of such email.

Do you receive my example of email (several hours ago)? I wonder if your
FAI-webmail or your own server directly delete it since it was a
known-virus.

Vince

 

[Diane Poremsky [MVP]]

No I didn't - it's also not in my AV scanner quarantine or junk email. Did
you get any error messages back?

Try dragging the message to the desktop and zipping it, then sending the
zip. That will get past any scanner.

--

 

[Vince]

No I didn't - it's also not in my AV scanner quarantine or junk email. Did
you get any error messages back?

Try dragging the message to the desktop and zipping it, then sending the
zip. That will get past any scanner.

I couldn't save an example of a virus email, McAfee does not allowed it.

I have succeed to transfer an example to you. What happened with your
Outlook? Does Outlook try to send alert email to people?

 

[Vince]

Diane,

I couldn't save an example of a virus email, McAfee does not allowed it.

I have succeed to transfer an example to you. What happened with your
Outlook? Does Outlook try to send alert email to people?

Do you receive it without problem like detection with your AV scanner
which disable you to analyse it?

I thought about something. I disable my AV scanner to produce a zip file
of an example of virus email. Can I send to you to analyse it?

Thanks.

Vince

 

[Diane Poremsky [MVP]]

yes, send it to me - drcp @ poremsky.com

--
Diane Poremsky [MVP - Outlook]
Author, Teach Yourself Outlook 2003 in 24 Hours
Coauthor, OneNote 2003 for Windows (Visual QuickStart Guide)
Author, Google and Other Search Engines (Visual QuickStart Guide)



Join OneNote Tips mailing list: http://www.onenote-tips.net/

Vote for your favorite Outlook and Exchange utilities in the
Slipstick Ratings Raffle at http://www.slipstick.com/contest/

 

[Vince]

yes, send it to me - drcp @ poremsky.com

I sent you 3/4h ago.

Vince

 

[Diane Poremsky [MVP]]

hmmm... it's nowhere to be found. What is the subject? I'll see if I can
find it in my message logs.

--

 

[Vince]

hmmm... it's nowhere to be found. What is the subject? I'll see if I can
find it in my message logs.

No trace in your Outlook, lucky!

My email was sent Thu, 15 Jul 2004 00:47:52 +0100, with 'Re: Emails
always sent to the same persons, after receiving a virus' as subject and
with the file 'Re Hi.zip' containing my outlook message (.msg).

Vince