Worm problem

[Scott Pearson]

A lot of worms read through the address book (usually Outlook or Outlook 
Express address book) and then mass-mail advertisements to those people 
listed in the address book.  They also will take these addresses and put 
them into the reply to and from fields of the emails they send out.

What this means is that somebody, most likely on a Windows machine, had 
your email address in their address book (if you have posted anywhere on 
the net and someone sent you a reply, most email programs will then 
store your address on their PC when they replied to you), got their 
machine infected, and you are now getting not only the emails, but the 
bounced emails because the worm on their machine puts in your addy in 
the reply to and/or from field and the servers send it to the address in 
those fields.

Quite a few spammers also stick the person's email addy in the from and 
reply to fields also in an attempt to get by spam filters.

It is an annoyance.



lloyd545220-trucker at yahoo.com wrote:

>It appears that I got a mass-mailing worm on my FC3 system the other
>day. I discovered it when I got an email from myself to an alternate
>email address. It was an advertisement for the following site:
>
>
>http://www.thenetpanel.com/thankyou.asp?u=2913335
>
>
>I had 'chkrootkit" on my system and I ran that afterwards. It
>reported that my system is clean.
>
>I installed F-Prot's virus software afterwards on this computer and
>had it check my system. It also reported that there no problems to be
> found.
>
>My FC3 system has Selinux installed and all files are up to date. I
>also have "Shorewall" installed.
>
>I can't find any trace of it now, but I am getting lots of emails
>about undeliverable email from me to people in my address book
>stating that an email sent from me had " 6 x Worm.Sober.P." in it.
>
>It also seems to have been a one time thing.
>
>But I had thought that these worms were only for MS system...
>
>Any ideas here?
>
>Lloyd
>
>lloyd545220-trucker at yahoo.com
>
>Lloyd Hayes
>
>Web Journal:  http://lloyd_hayes.bravejournal.com/
>Web Site:     http://talkingstaff.bravehost.com
>
>  
>