Re: Swen Virus

From: N. Miller (koko_at_soko.invalid)
Date: 09/26/03 

Date: Fri, 26 Sep 2003 13:23:35 -0700

In article <0e3601c383d7$2794db20$a401280a@phx.gbl>, pauljs1@optonline.net
says...
> ...my question is if
> there is any kind of resource available to help me track
> down where these are coming from??? I can get the header
> info, but it's tough to follow. The problem is serious
> because my ISP provider uses web mail and I download it
> via Outlook 2002, but my web inbox is getting about 180
> of these every single day!

Your problem stems from having used a working address to post to a public
news group. I have known, since three years ago, that spammers harvest NNTP
posted email addresses in the "From:" line of posts. Now along comes Swen,
which even grabs email addresses from the "Reply-To:" line of posts. Nothing
much that you can do about it now, unless you wish to change your address.

Actually, chasing the offender may be both easy, and hard. Check the
"Return-Path:" email address in your headers against the "Received:" line
which records the receipt of the message by your provider. Every Swen email
I have checked matches; with Klez, they never matched. If the domain name in
the email address is consistent with the sending server, try sending an
email to that address.

But, this is where the "hard" comes in. Every message that I have sent has
bounced off of a full account. I still can't confirm that the "Return-Path:"
address is the actual source of Swen. I am guessing that the address was
used in an NNTP post by the owner, that he is getting swamped, as you are,
and that he almost certainly was suckered in by the forgery, and infected
himself; and is probably blithely unaware that he is infected. Or the
address was forged, and the poor sap is getting bounces back to his address
from automated systems that don't care if it is a forgery.

I have only sent three manual requests for confirmation from the account
owner; all have bounced off of full mailboxes, and I am reluctant to send a
response to any more, lest I be contributing to the problems of the account
owners. 

-- 
Norman
~Win dain a lotica, En vai tu ri, Si lo ta
~Fin dein a loluca, En dragu a sei lain
~Vi fa-ru les shutai am, En riga-lint

Relevant Pages

  • Re: Bouncing E-Mails?
    ... I already know and mentioned that the From header is highly likely to be bogus and may point at an innocent who ends up getting the boobs bogus bounces which are themselves spam. ... If the destination domain is valid but there is no such account at that domain, you waste the resources of the receiving SMTP server to accept the mail session with your sending mail server and then send back an NDR to your mail server which then sends it to you to tell you there is no such user at that destination. ... If the account exists and it was created by the spammer to send from there, ...
    (alt.computer.security)
  • Re: e-mail address mining tool?
    ... receiving bounces from inexistant accounts, ... default-account strategy and all your mail will end up on one account, ...
    (Pen-Test)
  • Re: Nmae of Profile in XP Home
    ... Settings, its name is not Daave, but rather it is still Owner. ... The correct way really is to immediately abandon the Owner profile ... To change the name of your Documents and Settings\UserName folder: ... 1- Log on to your account and use the SET USERPROFILE command to ...
    (microsoft.public.windowsxp.general)
  • Re: User accounts
    ... Just copy over the ones you want to your own folder. ... "owner" folder (the system does not allow for renaming of the user account ... If your account is using the "jack" username folder, ... Windows help - www.rickrogers.org ...
    (microsoft.public.windowsxp.newusers)
  • Re: I am unable to switch ownership of files in a prior C: Hard drive
    ... Home didn't have the SECURITY tab in Explorer properties. ... You needed PRO to take ownership of files. ... owner and edit and changed the owner to that of my VISTA administrator ... account by selecting as a new owner my new admin account, ...
    (microsoft.public.windows.vista.administration_accounts_passwords)