KB 248
Why am I getting all these bounce messages from mail I didn't send?
Article:248 Created:2003-08-28 11:30:57 Categories: E-mail Virus Information
Question or Symptom
Do I have a virus?
Resolution
The message in question is a bounce message from a mail server that received a virus infected file. This is the results of wide-spread infection which is curently plagueing the internet in the form of the "SoBig.F" virus. This virus attempts to replicate itself by sending itself to everyone in an infected machine's Address Books, and in a new twist, every email address in their "Temporary Internet Files" folders.
The reason you in particular received this message is that this clever little virus forges the headers of the emails it sends to include a random address from the list it has harvested from the infected machine into the "From:" field. It does this to both mask its origin by leading recipients to think the infected messages came from the forged address, and to mask its activities, as the owner of the infected machine would likely run an Anti-Virus program against the machine if they started getting hundreds of bounce messages. Since you're getting the bounce messages that their system is causing, they frequently have no idea that they are in fact infected.
Sadly there is no way to combat this unfortunate occurance, other than to simply delete all the bounce messages. It is *always* advisable to protect yourself and your system by installing an Anti-Virus application, keeping its Virus Definition Files current and updated, and to practice safe emailing.
Do not open attachments in emails from people who you don't recognize.
If you get an attachment from a name you do recognize, check with them to see if they actually emailed you an attachment before opening the one you just got.
Never give out secure personal information over email (Credit card numbers, passwords, Social Security numbers) at any time for any reason. You may trust the recipient, but the possibility exists that your message might be read by someone less scrupulous that your intended recipient, and the easiest way to protect yourself is to safeguard your private data.
Below are some pointers to more information on the SoBigF virus.
Related URLS
http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.html http://www.cert.org/incident_notes/IN-2003-03.html http://us.mcafee.com/virusInfo/default.asp?id=helpCenter&hcName=sobig
