I, like everyone else, have been bombarded by the W32.Sobig.F@mm worm.
Most of what I have been getting are "warning" messages from my internet provider, informing me that they have filtered the virus out of my incoming mail.
Some are messages that the service apparently misses. The fake messages show up on my e-mail with the usual spoofed addresses and "see attached file" gimmick. Norton gives no indication that it has dealt with this, but the attachment is not there, so one assumes Norton has plucked it off and deleted it. Would be nice if it told me so.
Then there are more disturbing messages. Messages that tell me an attempt by my computer to e-mail a complete stranger have failed. I assume these are virus related, and for a while I was worried that my computer was infected and mailing people without my knowledge. Of course, the virus picks its destinations out of my files, and I recognized none of the destinations, so that seemed to be evidence that these e-mails were fakes as well. Symantec does not describe this particular behavior on its information on the W32.Sobig.F@mm.
Two samples:
Your eMail with the following data could not
be delivered within the last 1 hour(s):
Send from ..........: [my address]
Send on ............: 23 Aug 2003 23:53:14 GMT
Subject ............: Re: Thank you!
Send to (Status) ...: - Saiwebmaster@saisystems.com (IN QUEUE)
Your message
To: rmpeluso@switch.com
Subject: Re: Approved
Sent: Sun, 24 Aug 2003 03:58:21 +0200
did not reach the following recipient(s):
c=US;a= ;p=Union Switch ?
S;o=Pittsburgh;dda:SMTP=pelusorm@exchptc1.switch.com; on Sun, 24 Aug 2003
11:59:38 +0200
The recipient name is not recognized
The MTS-ID of the original message is: c=us;a= ;p=union switch ?
s;l=EXCHPTC10308240959R20F5T5LMSEXCH:IMS:Union Switch & Signal Inc.:Pittsburgh:EXCHPTC1 0 (000C05A6)
Unknown Recipient
Subject:
Re: Approved
Sun, 24 Aug 2003 03:58:21 +0200
From: [my address]
To: rmpeluso@switch.com
See the attached file for details
There is a text file attached to the latter. A scan reveals no virus.
I have long ago downloaded the latest Symantec definitions and the clean-up program. The cleanup program says I'm not infected.
This whole thing makes me nervous. Anyone else getting this kind of behavior?