weird spam in yahoo accounts - GoFuckYourself.com

tina2 · 06-04-2004, 03:59 AM

i just was wondering. i have some spam on my yahoo account that is quite weird. i get spam emails with viruses coming from the same email address i use to send... for instance, if i send an email to [email protected] i might get an email back like this:

[email protected] with the subject: RE: your document, and an attached file which is a virus...

does any yahoo user have the same problem??

digifan · 06-04-2004, 04:01 AM

Never... it sounds weird.

strobi · 06-04-2004, 04:54 AM

happens to me alot. I get like 500 of those/day on one of my domains.

Fonz · 06-04-2004, 04:57 AM

i get like 800 a day on one of my domains that say stuff like "change ur current job now talked " and "y stupidly working for low salary?"
Somehow they all seem to get past my ISP's spam filter (which worked perfect until this shit started)

jawanda · 06-04-2004, 06:39 AM

Nah, they're not actually using the mail server on your domain.

They are using an open relay of some sort ... possibly an outdated send mail script, or just a normal non-secured smtp server.

old, unsecured smtp servers (they used to almost all be this way) will relay email TO and FROM just about anyone without confirming the senders identity.

Thank God they are slowly but surely getting updated / shutdown.

-P

silent_jinx · 06-04-2004, 07:37 AM

The recipient you are sending email is most likely infected with the Netsky virus.

"W32/Netsky is a family of mass-mailing worms that spread by email using addresses obtained from the infected computer. They have their own SMTP delivery engine that sends infected messages directly to the recipient's mail server. It also spreads via local networks by trying to copy itself to shared folders on drives C: to Z:. The worms randomly select an address as the "From:" address: therefore the apparent sender of the infected email is not the real sender and their computer is probably not infected.

The subject header of the message is randomly chosen from a large number of strings. The message text is also randomly chosen. In most cases, the message is meant to look like a system generated message, such as an error report from a mail server.

The worm is contained in an executable file attachment, whose name is also chosen from a large number of possible names. It may or may not have a double extension (like mp3.pif) and it may be contained in a Zip or Rar archive, which in some variants may be password protected.

When activated, the worm may display a message. The worm then copies itself to the hard disk and installs a Registry entry so that it is run automatically at startup. The worm then executes this file in order to propagate using the methods described above.

W32/Netsky variants remove registry values in order to deactivate some earlier viruses, if present. Some variants may initiate a denial-of-service attack on certain websites at certain periods, others can be used as a backdoor into the system if not blocked by a firewall.

W32/Netsky.V installs an FTP server and a web server on the infected computer, which can be used by an attacker to obtain information about the system or install other malicious software, once alerted by an email sent by the virus."
[Source: Tech-Pro.net ]

You can download a removal tool from Symantec

I had the same problem, i was receiveing/sending out those emails, without my knowledge, but after running the removal tool, everything went back to normal and get rid of this ugly virus.

Take care

tina2 · 06-07-2004, 03:45 AM

hey thank you very much for all you info and help!!!

marko13 · 06-07-2004, 04:17 AM

yes i have same problem with spamming and usualy i don't open it because few friends are sending me e-mails os i don't beleive to any of that e-mails...

06-04-2004, 03:59 AM	#1
tina2 Confirmed User Join Date: Mar 2004 Location: everywhere Posts: 238	weird spam in yahoo accounts i just was wondering. i have some spam on my yahoo account that is quite weird. i get spam emails with viruses coming from the same email address i use to send... for instance, if i send an email to [email protected] i might get an email back like this: [email protected] with the subject: RE: your document, and an attached file which is a virus... does any yahoo user have the same problem?? __________________

06-04-2004, 04:01 AM	#2
digifan The Profiler Industry Role: Join Date: Oct 2002 Location: ICQ 76281726 and I'm female Posts: 14,618	Never... it sounds weird. __________________ [email protected] Webair Rocks

06-04-2004, 04:57 AM	#4
Fonz Confirmed User Industry Role: Join Date: Aug 2003 Location: Hellgium Posts: 486	i get like 800 a day on one of my domains that say stuff like "change ur current job now talked " and "y stupidly working for low salary?" Somehow they all seem to get past my ISP's spam filter (which worked perfect until this shit started) __________________ hardlinks for sale - ICQ 24298240 - linksatsmilinpussy.com

06-07-2004, 03:45 AM	#7
tina2 Confirmed User Join Date: Mar 2004 Location: everywhere Posts: 238	hey thank you very much for all you info and help!!! __________________

06-07-2004, 04:17 AM	#8
marko13 Confirmed User Join Date: Apr 2004 Location: www.lvpshosting.com Posts: 7,512	yes i have same problem with spamming and usualy i don't open it because few friends are sending me e-mails os i don't beleive to any of that e-mails... __________________ We are responsible for your hosting ... Enjoy in your life. Shared hosting from $3.95 Europe Linux VPS plans from $11.37 http://www.LVPSHosting.com

06-04-2004, 04:54 AM	#3
strobi Confirmed User Join Date: Nov 2002 Location: Belgium Posts: 7,383	happens to me alot. I get like 500 of those/day on one of my domains.

06-04-2004, 06:39 AM	#5
jawanda Confirmed User Join Date: Feb 2003 Posts: 6,040	Nah, they're not actually using the mail server on your domain. They are using an open relay of some sort ... possibly an outdated send mail script, or just a normal non-secured smtp server. old, unsecured smtp servers (they used to almost all be this way) will relay email TO and FROM just about anyone without confirming the senders identity. Thank God they are slowly but surely getting updated / shutdown. -P

06-04-2004, 07:37 AM	#6
silent_jinx Registered User Industry Role: Join Date: Mar 2004 Posts: 39	The recipient you are sending email is most likely infected with the Netsky virus. "W32/Netsky is a family of mass-mailing worms that spread by email using addresses obtained from the infected computer. They have their own SMTP delivery engine that sends infected messages directly to the recipient's mail server. It also spreads via local networks by trying to copy itself to shared folders on drives C: to Z:. The worms randomly select an address as the "From:" address: therefore the apparent sender of the infected email is not the real sender and their computer is probably not infected. The subject header of the message is randomly chosen from a large number of strings. The message text is also randomly chosen. In most cases, the message is meant to look like a system generated message, such as an error report from a mail server. The worm is contained in an executable file attachment, whose name is also chosen from a large number of possible names. It may or may not have a double extension (like mp3.pif) and it may be contained in a Zip or Rar archive, which in some variants may be password protected. When activated, the worm may display a message. The worm then copies itself to the hard disk and installs a Registry entry so that it is run automatically at startup. The worm then executes this file in order to propagate using the methods described above. W32/Netsky variants remove registry values in order to deactivate some earlier viruses, if present. Some variants may initiate a denial-of-service attack on certain websites at certain periods, others can be used as a backdoor into the system if not blocked by a firewall. W32/Netsky.V installs an FTP server and a web server on the infected computer, which can be used by an attacker to obtain information about the system or install other malicious software, once alerted by an email sent by the virus." [Source: Tech-Pro.net ] You can download a removal tool from Symantec I had the same problem, i was receiveing/sending out those emails, without my knowledge, but after running the removal tool, everything went back to normal and get rid of this ugly virus. Take care