Please or to access all these features

Add post

Watch this thread

Save thread

Start a new thread

Flip thread

Hide thread

My feed

Active Unanswered threads

Getting started FAQ's

Unanswered threads Acronyms Talk guidelines

Hide shortcut buttons

Talk

Other subjects

Flip

Original poster

is this a virus alert? or just a virus?

11 replies

jamiesam · 15/10/2004 15:06

Twice over the past week I've received an e-mail from sender 'amavisd-new' with message title 'VIRUS () IN MAIL FROM YOU' (Didn't type the whole thing just in case).
Does anyone know if this is legit? I just deleted the first one assuming it was a virus that had got past security. However, it's back in my inbox now and I'm worried in case it is legit. And in case it isn't.

OP posts:

WigWamBam · 15/10/2004 15:09

Amavisd-new is a firewall and is legit. Do you know if you have this firewall installed? If you do then it may be telling you that you have a virus and are transmitting it.

Don't know how you would tell though.

Original poster

jamiesam · 15/10/2004 15:14

Thanks WigWamBam.
Have absolutely no idea about firewalls. Will try search for evidence of amavisd on our computer.
By the way - would firewall allow me to e-mail but stop me passing on the virus - wondering if MN have this firewall and are sieving out this virus from my posts?

OP posts:

NotQuiteCockney · 15/10/2004 17:52

Unless you're posting to MN via email (is this possible?) MN isn't going to be catching any viruses from you.

This does look like a real virus warning, not a hoax/spam/virus. At least, I can't find any online reference to this as a fake alert. And as WWB says, amavisd-new is a real firewall (possibly only under linux?).

It's possible, if you don't have amavasd-new yourself, that someone you email has it, and it's their firewall that's catching it? I'd look at the sender's email address, as that might tell you something useful.

Obviously, you should ensure your antivirus is current. Alternatively, go to Trend Micro to scan your pc and see what, if anything, it's caught.

SenoraPostrophe · 15/10/2004 18:28

jamiesam - sounds like someone has "spoofed" your address to send emails with viruses. If you've only had a couple it's highly unlikely you actually have a virus. Just delete them.

CleanKittyCat · 15/10/2004 18:30

best thing to do is get an anti-virus software, like Norton, or Panda there are some like PC Doctor, avalibale for download from PCworld.co.uk download and run this will ell you if you have a virus and how to get rid of it.

HTH

WigWamBam · 15/10/2004 18:30

No, I don't think it's a spoof, this is a genuine message that comes back to a sender when their email has been rejected, either by their own system or the system of the person they have sent the message to - if that's the case their firewall will have caught it and this is the (genuine) message that comes back telling you that your email has not been delivered.

WigWamBam · 15/10/2004 18:34

What I mean is, these messages may only be coming infequently because jamiesam is only sending messages to one person with amavisd-new, so only the few to this person are being bounced back.

NotQuiteCockney · 15/10/2004 18:35

Ah, yes, good point, SenoraPostrophe - some viruses fake the email address they're coming from - generally picking the address of someone else in the infected person's address book.

So person A out there has your address and person B's address in their address book. The virus sends itself to person B, but makes it look as if it comes from you. Person B's firewall sees the virus and sends you a message about it. This has happened to me a few times, and I've not managed to work out who's actually infected, beyond knowing it's not me.

So it might not be you who's infected. Either way, it's probably worth making sure your anti-virus is up to date. It's always worth making sure your anti-virus is up to date.

Which virus is it, jamiesam?

Original poster

jamiesam · 15/10/2004 21:31

Thanks a lot chaps. But I'm not clear what to do now!
The virus in the brackets (not quoted in my original mail) is w32/bagle.aa at MM (typed at as at iykwim)
Does anyone know how bad this virus is, or indeed anything about it.
Rather wetly I waited this evening to talk to my dh about this - and he opened the e-mail. So if it's evil, my computer is trash!
And the e-mail indicated that the recipient wouldn't have received my message, but can't think what I have sent recently that has not been received?
More help needed here please!

OP posts:

NotQuiteCockney · 16/10/2004 15:15

Ok, I've spoken to dh, who deals with this sort of thing for a living. And Bagle is a real virus, which spoofs addresses. So, as SenoraPostrophe pointed out, you probably aren't infected: this is a geniune virus response, but it's responding to your address by mistake.

And the alert email didn't have a virus in it, and it hasn't infected you. Oh, but if the alert email included the original email with the virus, opening that would be a bad idea.

To be safe, go to Trend Micro and check to ensure your computer is not infected. Also, ensure you are regularly downloading the latest virus information for your antivirus.

Original poster

jamiesam · 18/10/2004 22:31

NotQuiteCockney
Thanks ever so much for that
Will do as instructed.

OP posts:

Flip