http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9254797 en Sat, 26 Mar 2022 03:46:47 EDT Sat, 26 Mar 2022 03:46:47 EDT http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9268082
It's time to either diagnose the problem AND/OR take corrective action, because I have come to enjoy my Cox connection's reliability, and this is not making me feel to terribly good.

-Greg]]> http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9268082 Mon, 02 Feb 2004 18:46:47 EDT http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9267671 http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9267671 Mon, 02 Feb 2004 18:08:48 EDT http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9267619 http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9267619 Mon, 02 Feb 2004 18:04:38 EDT http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9267598 http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9267598 Mon, 02 Feb 2004 18:02:39 EDT http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9264598
I've got my email set up so that anymail that comes to my domain without a vaild email address prefix shows up in my in box.

As a result, I'm getting TONS of non-deliverable reports being addressed to me from other mail servers. When I look at the headers I can see that this virus is sending out mass emails with my domain name on them and when they don't have a valid destination address they come back to me as non-deliverable.

It's kind of interesting because I can see that the virus is spoofing my domain as a return address and creating all sorts of bogus user names. If you figure a 40% delivery failure rate it would probably mean the virus has sent around 1600 emails out with my domain name on them :-O

Because people have to register via email to use my forum I suspect that the virus picks up my domain name from their email programs when those users were infected and now I'm seeing the results of infected users who have registered on my site. It's most likely caused by users having Outlook Express automatically adding people replied to in the address book.

So when they register for my forum they get an email that they have to reply to in order to access the forum. When that happens my forum's email address get's added to their address book. Then they get infected with the MyDoom virus and it grabs all their email addresses from their address book and starts blasting of virii using my domain as the sender. When those emails don't go to a valid email address or get picked off by a mail server as virii infected a non-delivery report gets sent back to my domain's mail server and then routed to me.

So I get to see first hand how this virus is taking shape :-) I've got 819 now but looking on the bright side I did get a real SPAM from Zimbabwe. It seems someone there needs helpd dispersing 30 million dollars and I get to play a part in that dispersment!
--
Double Your BroadBand Speed @ »www.askmarvin.ca]]> http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9264598 Mon, 02 Feb 2004 12:52:07 EDT http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9262371 said by marvinmiller:

---

Just out of curiosity - do you ever wonder how much faster the Internet would be if we could instantly remove all spam and virii from it?

---

I've seen estimates of total traffic in spam alone ...
Throw something like Welchia or MyDoom in and depending on ...
A whole lot better?
The writings on the wall, the "cost of business" is going up for either "us" or "them". ]]> http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9262371 Mon, 02 Feb 2004 05:10:46 EDT http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9262334 said by marvinmiller:

---

I've had 743 emails show up

---

Did these pull from a Cox pop account?]]> http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9262334 Mon, 02 Feb 2004 04:48:15 EDT http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9262191 --
Double Your BroadBand Speed @ »www.askmarvin.ca]]> http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9262191 Mon, 02 Feb 2004 03:35:46 EDT http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9262124
To make matters worse - it's also using my domain name to send out a whole slew of these virus emails - nice :-(

When I first heard of it on the news it explained the emails I was already getting. When I looked into the virus and the way it was made to propagate I came to the same conclusion - this one's going to be rampant.
--
Double Your BroadBand Speed @ »www.askmarvin.ca]]> http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9262124 Mon, 02 Feb 2004 03:15:06 EDT http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9257572 I've wondered if they haven't quietly done something like this as I've never seen any of them.
I do know Cox takes it seriously and makes a concerted effort to stay on top of things like this.
Anybody seen one of these on a Cox account?]]> http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9257572 Sun, 01 Feb 2004 17:38:35 EDT http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9255127 http://www.dslreports.com/forum/Re-RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9255127 Sun, 01 Feb 2004 13:20:21 EDT http://www.dslreports.com/forum/RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9254797 http://www.dslreports.com/forum/RI-MyDoom-Virus-could-be-a-cause-behind-the-packeting-9254797 Sun, 01 Feb 2004 12:41:29 EDT