[greeting card.exe]

[greeting card.exe] - Computers

Search Tech-Forums - link takes you to our Forum's search page.

Note: The following is only a text archive!

To view the actual forum discussion, please visit our website at http://www.tech-forums.net

Pages:1

greeting card.exe
(Click here to view the original thread with full colors/images)

Posted by: genistas

Hi,

I'm working on a customer's computer. About two weeks ago they started receiving the following types of emails, a couple of dozen a day:

Undeliverable Mail
Mail Delivery Failed
Returned Mail
etc...

Apparently a virus was trying to send the file Greeting Card.exe to random addresses, not just addresses in the address book.

So after full Norton and AVG scans (with the hard drive in the system and in an enclosure on another system), no viruses are detected and I decide to format the drive and start over. A week goes by before I get around to finishing the install. Before setting up Outlook Express, I log into the email account through web mail access. Keep in mind that the email account had not been logged into for a week. Through the webmail access, I'm still receiving one of these emails every hour or so, even though the infected computer had been wiped clean a week ago and the email account hadn't been used during this time. In fact, the account had received about the same number of these emails every day since I formatted the hard drive.

So the question becomes this: how are these emails being sent from this email address when no computer, email program, or person has been accessing the account? Could there be an infection on the mail server? I've considered the fact that these may be leftover messages from attempts made last week, but the number of messages doesn't seem to be going down any.

Any help on this would be greatly appreciated!

-Dan

Posted by: Kubel

A couple possibilities:

1) The email was spoofed and mailservers are rejecting the virus emails and returning them to your clients email address thinking that's where they came from. The best solution here would be to change email addresses or just set up a filter to automatically delete or mark these messages as spam. If your client owns or operates the mailserver and wants to change email addresses, just have them blackhole any messages coming in for the old user.

2) The email account was compromised and viruses were being sent out and then bounced back. The best solution here would be to change your password and/or get a new account.

3) The mail server was compromised and viruses were being sent out and bounced back. You would have to get in contact with the administrator or service provider.

#1 is most likely the issue. But just to be safe, you can try contacting the email service provider.