• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

OT- need a little help

Dantoo

Golden Member
This does concern computers that are cracking for us so there is some framework for posting it here 🙂

Is there anyone here aware of a virus/worm/trojan that causes the following problem? Trillions of replies from emails to addresses that don't exist from emails that clearly weren't sent (or not to the knowledge of the user anyway). Did I say trillions? Sorry, only several thousand or so a day!

Virus check finds nothing. Lots of "nobody at this address" responses are coming in from pop servers from around the world (currently a series from France). The emails are being returned to the email address of one particular machine on a LAN connected to the net permanently.

I know we have more than a few sys-admins here, anybody got a clue?

thx
Dantoo
 
As far as I know Klez and its variants are all easily detectable by the virus checker in use (up to date). The other thing is that the address list isnt from the windows address book its generated elswhere. Me very puzzled. 🙁
 
Dantoo, take a look at the headers if you can (sometimes a 'reply' will give you the original message as an attachment).
What this worm does is when it infects a system - it gets addresses from the inbox, sent itesms and where ever there are messages to cull addresses from on the infected system. Then it starts sending itself out "To:" addresses it has found "From:" one or more of the addresses it has also found. Obviously they don't come from you, a quick look at the header will tell you what IP address the messages are really from and you will see if you have any idea what your IP address is that they come from someone else.
WHat can you do about it - not much unless you can figure out who out there has your address and these others in their system or if you can trace the offending IP address. Trouble is that if others get infected by this worm as it uses your address
1. they will blame you (wrongly, these things are not coming from your systems!!)
2. the effect will snowball and you will see more of these
3. you will lose a lot of sleep

I've been fighting this one for months, I am fortunate that I run my own server so I can filter and virus check all outgoing mail.
The other thing is that while using your address it tries to send itself out through your SMTP server.
Good luck.
 
Wiz thanks - not really sure i understand you there.

The fact that the rejected mail comes from mailboxes that obviously doesnt exist is one thing that is screwing with my mind.
quick look at the header will tell you what IP address the messages are really from and you will see if you have any idea what your IP address is that they come from someone else.

Sorry I am lost here, the messages i am receiving are from mail servers that have bounced the "original" that obviously has a copy of "my" email address as the originator.

The other thing is that while using your address it tries to send itself out through your SMTP server.

So the outgoing mail is coming from "my" machine then?

This worm is Klez or something else??

Thx
 
So the outgoing mail is coming from "my" machine then?

NO

It is being sent out through "your" smtp server, the smtp (outgoing) server of your ISP. Unless you run your own, but very few of us do that 😉

This worm is Klez or something else??

It is a KLEZ but I don't know which one.

If you had KLEZ your antivirus would find it, your machines are not infected and you are not sending out the emails.
In the headers it says things like (here is an example trapped on my own mail server):

"SMTP 6 Jul 2002 10:57:42 F 3096 404 mail from rbastedo@GygaBite.com [172.178.81.176] to MariaMary411@aol.com - invalid header"

What we can tell from this:

"SMTP" is the smtp server log entry
"6 Jul 2002 10:57:42" when this happened
"F 3096 404" some codes that don't matter to this discussion
"mail from rbastedo@GygaBite.com" apparently this mail is from me
"[172.178.81.176]" the IP address of the infected real sender, but that's not my IP address
"to MariaMary411@aol.com" the intended victim
"- invalid header" what my mail server does after the AV program blocks the message

That's why I said to look at the message header, it will say what IP address the real sender is using. You can find your internet IP address and compare the two. This is a case of origination spoofing that is easily detectable, you have an IP address and the real sender has a different one, therefore the messages are not coming from you. They may or may not be going out through your ISP's smtp server, that is merely because the virus creator knows there isn't much chance at success unless it is done this way, most email servers block foreign users and only allow sending by it's own users.

Clear as mud yet?
 
Ah light dawns!!!!!

Somebody has Klez. The worm has picked up the address from their machine and is using it as a spoof. If I can find the IP address of the originating machine I can do two things:

1. Prove its not me
2. Backtrack the offender and ask them to clean the machine.

errr right? 😀
 
Yes, that's right.
Tracing will likely prove difficult, most people connect with a dynamic IP so they will have had that IP only for a single session.
From the header of a message you can find the IP and the time the message was sent, trace to an ISP & tell them one of their users is doing this. Then they can contact their customer, if they have the right customer service in place. If it's a big house I doubt very much they will care.
If it's a broadband user you might have better luck, as they hold onto IP's longer than dial up's.
 
------ This is a copy of the message, including all the headers. ------

Return-path: <ansa@ansa.com.au>
Received: from 1cust159.tnt73.nyc3.da.uu.net ([63.16.15.159] helo=helo)
by sire.mail.pas.earthlink.net with smtp (Exim 3.33 #1)
id 17QzJX-0002e7-00; Sat, 06 Jul 2002 16:50:08 -0700
From: ansa@ansa.com.au
To:
Subject: You know, most people are just too darned busy earning a living
or running
Date: Sat, 06 Jul 2002 18:29:35 -0400
X-Priority: 1
X-MSMail-Priority: High
Errors-To: software2002market@yahoo.com
X-Mailer: Exchange Mail Server 2002/98/95
Message-Id: <E17QzJX-0002e7-00@sire.mail.pas.earthlink.net>

THIS TERRIFIC BOOK is a collection of powerful order-pulling
letters which brought in big profit dollars to THOSE WHO USED
THEM. Now they are for your use and profit. The money secrets
these letters contain are explained so that you will fully understand
what makes each letter work so successfully and lern the mil-dollar
secrets they contain.

The letters are so DYNAMIC, so POWERFUL that some were used
to sell items no one believed could be sold by mail. Yet tons of
dollars worth of this merchandise was sold using these letters.

Get this, one man brought in over $1, Mil.. in orders HIS FIRST
SIX MONTHS OF BUSINESS.
The book tells how one firm used 4 letters to build a MULTI MIL-DOLLAR
COMPANY.

Another man on the verge of bankruptcy used one of these letters and
cleared over $200,000 in a few months selling a very common item
that was readily available at any retain department store and in 5 years
had made over $2, Mil- with this one letter and one product..got it?

Each letter is written in an action-compelling and concise manner which
brought the money POURING IN. One letter was so powerful, so
compelling, so DYNAMIC it actually pulled better than 90% RSPONSE
and brought in over $13, Mil.... You need to get started...fast!

FREE REPRINT RIGHTS..
As a bonus, you will be granted reprint rights to this book and can
reproduce it in any manner you wish. You can profit by using the
secrets and selling the secrets.

This camers rady, 8 ½? X 11? book is spiral boound so that it
lays flat and ca be easily copied by you or your printer.

2000% PROFIT ON EVERY SALE
If you have been looking for a product tnat sells itself, a product
that is high in demand, costs very little to ship, easy to store and
one that doesn?t break - YOU?VE FOUND IT! You can reproduce
this book for pennies and sell it for dollars - up to 2000% profit
on every sale. This is a very good buy - You?ll get your money back
on the very first copy you sell.

Follow the directions below and send for your copy today and begin
making up to 2000% PROFIT TOMORROW-Hurry..don?t delay!
Options:
1) yes-send my copy of ?mil-dollar order-producing
sales letters? TODAY.I realize that I have just(3) business day
remaining for this amazing program..Iam enclosing $20.+$5.00
for priorty s&h check/or money order.for A Low,Low Investment
Of Only $25.00

2)RUSH MY ORDER Iam Faxing My Check To the ACH-Dept For
Same Day Shipping:** (801)998-6723** An advocate will Call
The Same Business Day To Confirm Your Order! Make Check
or money order, payable To Quickproducts..Thanks !

MAIL TO:
QUICKPRODUCTS
341 Parkridge Ave 1st-Floor
Buffalo,N.Y. 14215

If You Wish To Be Removed From Any Future Mailings,Go To:
http//www.hebalist.com/?idb5
Thanks ! (Remember Just 3-days remaining)

THIS TERRIFIC BOOK is a collection of powerful order-pulling

etters which brought in big profit dollars to THOSE WHO USED

 
That's very odd, I don't pretend to "know it all" but the only ones I've been seeing have stupid messages in the body like "the message is in the attachment" or some such thing when they are caused by a KLEZ infection. I've read that it can grab the body from another message though and send it.

So is that your IP address?

63.16.15.159

See what IPCONFIG /all in a dos window / command prompt says on the machine that is connected to the internet directly (assuming you are using windows). Is that you, or anything close to it?

When I tracert it I see that it looks like some kind of New York location.

C:\>tracert 63.16.15.159

Tracing route to 1Cust159.tnt73.nyc3.da.uu.net [63.16.15.159]
over a maximum of 30 hops:

1 <10 ms ... (my local stuff)
2 10 ms ...
3 50 ms ...
4 10 ms ...
5 10 ms ...
6 10 ms 10 ms 10 ms gbr2-p60.st6wa.ip.att.net [12.123.44.118]
7 10 ms 10 ms 10 ms gbr3-p80.st6wa.ip.att.net [12.122.5.165]
8 40 ms 30 ms 71 ms gbr4-p10.sffca.ip.att.net [12.122.2.61]
9 20 ms 30 ms 30 ms ggr1-p370.sffca.ip.att.net [12.123.13.69]
10 30 ms 30 ms 90 ms att-gw.sf.uu.net [192.205.32.126]
11 30 ms 50 ms 60 ms 0.so-2-1-0.XL1.SAC1.ALTER.NET [152.63.52.226]
12 30 ms 40 ms 70 ms 0.so-3-0-0.TL1.SAC1.ALTER.NET [152.63.53.250]
13 80 ms 110 ms 90 ms 0.so-1-2-0.TL1.NYC9.ALTER.NET [152.63.10.77]
14 110 ms 80 ms 90 ms 0.so-5-0-0.XL1.NYC9.ALTER.NET [152.63.0.174]
15 110 ms 100 ms 80 ms 0.so-0-0-0.HR1.NYC9.ALTER.NET [152.63.15.125]
16 80 ms 90 ms 80 ms 101.ATM3-0.DR3.NYC3.ALTER.NET [152.63.23.177]
17 81 ms 90 ms 80 ms tnt73.nyc3.da.uu.net [63.39.236.69]
18 261 ms 280 ms 230 ms 1Cust159.tnt73.nyc3.da.uu.net [63.16.15.159]

Trace complete.


Also when doing tracert to sire.mail.pas.earthlink.net [207.217.120.182] I get this:


C:\>tracert sire.mail.pas.earthlink.net

Tracing route to sire.mail.pas.earthlink.net [207.217.120.182]
over a maximum of 30 hops:

1 <10 ms ...
2 10 ms ...
3 10 ms ...
4 10 ms ...
5 30 ms ...
6 10 ms 70 ms 21 ms gbr1-p70.st6wa.ip.att.net [12.123.44.57]
7 10 ms 10 ms 20 ms gbr3-p70.st6wa.ip.att.net [12.122.5.157]
8 50 ms 50 ms 30 ms gbr4-p10.sffca.ip.att.net [12.122.2.61]
9 80 ms 40 ms 80 ms gbr3-p20.la2ca.ip.att.net [12.122.2.70]
10 40 ms 40 ms 40 ms gbr5-p60.la2ca.ip.att.net [12.122.5.89]
11 30 ms 40 ms 60 ms gar2-p360.la2ca.ip.att.net [12.123.28.169]
12 30 ms 91 ms 40 ms 12.127.139.6
13 40 ms 40 ms 50 ms vlan132-cr02-pas.neteng.itd.earthlink.net [207.217.1.44]
14 * 40 ms * vlan296-dnr02-pas.neteng.itd.earthlink.net [207.217.2.125]
15 * * * Request timed out.
16 vlan296-dnr02-pas.neteng.itd.earthlink.net [207.217.2.125] reports: Destination net unreachable.

Trace complete.


Your email is apparently something in Austrailia, and the IP of your email server is:
mail.hotkey.net.au [202.138.0.29]

So if you are physically "down there" now the message header clearly shows that the message originated somewhere in or close to New York and not from you.


 
So if you are physically "down there" now the message header clearly shows that the message originated somewhere in or close to New York and not from you.

QUICKPRODUCTS
341 Parkridge Ave 1st-Floor
Buffalo,N.Y. 14215

Don't you hate a smartass. 😛 LOL

Hmmm, for only $25 I can make millions. Boy, I'm excited. :Q


This is a real bummer Dantoo. When you get this resolved please let us know how you accomplished it. 😉

And in the meantime ... don't send me any e-mails. 😛 😀
 
Back
Top