Need help w/possible virus

[Grit]

As of last week, I started receiving about 20 or more e-mails a day stating a message I sent was returned because it was undeliverable. Sometimes, the message has an attachment called "attachment2" (no extension). The sender is always a first and last name of a male or female I do not know, followed by my e-mail address (example, John Doe <grit@cox.net>) (grit@cox.net IS my real e-mail address). The two hyperlinks in the message point to a website called RxPros.com. To my knowledge, no one on my contacts list has received any of these messages.

The e-mail is as follows (this is a text copy, but the e-mail is in HTML):

------------------------------
Holiday specials on : Phentermine -weight loss and Soma-pain relief

60+ other great products

Mens health Womans Health

Overnight Fedex shipping gets your meds to you promptly

http://rnx.6ijig6.com/FP <http://njd.6g5g67b.com/FP>










avery chantey misery smelt thomas

quiver berniece compass aileron rigorous

--------------------------------

I run a registered/updated version of Zone Alarm on my computer under medium control mode (component mode is learning). I run a regsitered version of Norton Anti-Virus from System Works 2003 that is still valid and download weekly virus updates. The anti-virus software runs under the recommeded mode in the background. I scan my system with AdAware (and use updated definitions) about once every 6-8 weeks.

I'm well aware of e-mail viruses and never deliberately click on an unexpected attachment or even a suspicious attachment from someone I know. I do not knowingly download spyware-type programs, download "warez", or engage in any file swapping. I do use Trillian for instant messaging with settings preventing any file transfers from anyone without my permission. I do occasionally use GameSpy's "GameSpy Arcade" (free version) to connect to on-line games (all of my games are store-bought, no "shared" or "cracked" games). GameSpy Arcade recently updated itself. The only 'new' program I installed recently that accesses the internet was Folding@Home.

I've updated my virus definitions, rebooted into safe mode, and NAV comes up empty (full scan, including archives, for all drives). AdAware comes up with nothing. I've cleared and re-set my permissions from Zone Alarm about 12 hours ago, but I'm still receiving these returned e-mails.

I would appreciate ANY insight into what's going on. I can't find any referrence to this at SARC.com, and I don't know what else to do.

 

[blodhi74]

what are the symptoms that lead U to beleive U have a vires ?

 

[capricorn]

It sounds to me like it's just a spammers particular way of spoofing email so that you'll open it. It's pretty easy to spoof the addresses in a email to make it appear you sent a message to yourself. The embedded link to RX Pros (http://njd.6g5g67b.com/FP/) convinces me it's just a spam ploy. I doubt it's a virus. Your email address just got picked up by a spammer. An email filter ought to be able to filter that one out.

-cap

 

[Grit]

I should have posted this under software. Sorry.

I left out a few things too... Running Windows XP Pro (registered) w/SP1 + other updates. Internet connection is a Road Runner via cable modem into a Linksys 4-port router (sorry, don't remember the model, but it's the basic one, version 2).

To me, it appears the behavior is that an unknown program is receiving e-mail lists AT my computer and then sending mass marketing e-mails out FROM my computer using my e-mail address. The messages I'm getting back are automated messages from various e-mail servers telling me the message was refused for various reasons (address no longer exists, mailbox full, etc.).

 

[dkozloski]

You have a trojan that is a spam forwarder. Look for an entry in your registry for syscpy.exe and delete it. A Google search on syscpy.exe will tell you more.

 

[Grit]

Thanks for the reply. I should add some more information.

There are no unexpected entries in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run entry of the registry.

According to sarc.com, syscpy.exe (and most worms, viruses, etc) seem to activate by placing an entry into this key or the startup folder. Is there any other way a virus or worm can be started/activated?