Slashdot Mirror

← Back to Stories (view on slashdot.org)

Am I a Spam Zombie?

Posted by Cliff on from the how-can-you-know-for-sure dept.

ReallyCurious asks: "Recently, I've noticed a lot of junk email in my inbox reporting 'Mail delivery failure' or 'Undeliverable'. Some of these had documents attached, so I figured this was just a worm variant. But these messages keep coming. I worry that my machine has been turned into a 'Spam Zombie'. I don't see any suspicious processes running, but maybe it only runs for a few seconds, and at irregular times. I run a Windows 98 laptop, sometimes wirelessly connected to broadband (a few hours a day, on average), but I had to remove my virus software years ago because it was locking my system up, so I'm wide open. I've tried to be a good citizen and have been shopping for new virus software, but prices are running $40-$70, and most of these are just for upgrades (not even counting the mandatory 'subscriptions')! Is there an open or free virus fighting solution that's reliable and available for Windows? I'd be happy to run it ASAP."

36 of 160 comments (clear)

  1. Well... by hookedup · · Score: 4, Informative

    It may not be your system spewing out spam, but simply someone spoofing your domain.. happens to me every once in a while

    1. Re:Well... by tooth · · Score: 2, Informative
      Yeap, AVG does a good job. It's certainly better than nothing.

      Also try the no cost version of Zone Alarm.

      These are basic and no cost bits of software I run on my parents machines (and Firefox ;-) ... Though I'd love to buy them a mac one day :)

    2. Re:Well... by walt-sjc · · Score: 3, Insightful

      Exactly. Email worms and spammers frequently forge the sender. The problem is clueless mail adminitrators that configure their mail relays to accept mail to anyone (even unknown users) and then generate a bounce message when it can't be delivered (user unknown...) All scanning (spam and AV) and user verification really needs to be performed at initial SMTP reception and not after the fact.

      Unfortunately, older versions of Exchange are stupid in this respect, and accept pretty much anything. I believe you even have to specifically configure the newer versions of exchange too to behave correctly (someone correct me if I'm wrong here... I no longer use exchange, just read about how 2003 works...)

      IMHO, if you are running an older version of exchange without a good Unix relay in front of it that can do all this validation and scanning for you, you are a big part of the problem.

    3. Re:Well... by Anonymous Coward · · Score: 2, Informative

      As he said, the email address is inactive, but is displayed on the web. Spammers don't just look on the web for email address to spam, but also address to spoof spam from. The only connection he had with the spammer was an http connection for 1/2 a second.

    4. Re:Well... by Idealius · · Score: 2, Informative

      The story submitter is worried about his machine, not someone elses and if he wants to be sure he has no spyware on his system he should use HijackThis by Merjin:

      http://www.spywareinfo.com/~merijn/ (official site, down ATM)

      http://www.tomcoyote.org/hjt/

      Many popular anti-spyware forums accept posting a HijackThis log their HijackThis expert members can examine and advise you on. (e.g. The LavaSoft AdAware forums allow this but they require you post an AdAware log first :)

      Anyway, HijackThis is fairly manual as far as you need to know what you're doing to use it properly. However, if spyware is on your system it will be in a HijackThis scan result as it shows your computer's startup programs/services (legitimate or otherwise) in all known places they exist on your computer.

      Also, removing persistent spyware can get complicated using anything and this applies to HijackThis, too.

      I suggest you use Process Explorer to aid you if you're ever in this situation:

      http://www.sysinternals.com/ntw2k/freeware/proce xp .shtml

      The common approach for persistent spyware is to have 3+ processes running on your system, one that actually performs the spyware function and the other two which monitor the spyware process and each other. With Process Explorer You can susped processes that monitor other dummy processes that all make sure you A. Don't remove their startup entries and B. Don't try and terminate the spyware's running processes. They don't monitor whether their buddies are suspended, though so you can just suspend all of them after you've identified them, end them all, then remove the HijackThis entries now that the spyware startup entries aren't protected anymore. :)

      There's also the 'Find Handle' feature which can be useful as some old methods of startup can run processes so they are a subset of Explorer rather than a seperate process name in Task Manager > Processes tab. This is also a good way to find spyware DLL's.

      Anyway, as a technician, that's what I would do. Learning HijackThis and Process Explorer allow you to tune up a computer like you would a car.

    5. Re:Well... by sheddd · · Score: 3, Informative
      Instructions on how to do recipient filtering w/exchange:

      Here and here

      (btw filtering is off by default)

  2. No by sa3 · · Score: 4, Insightful

    The bounces you're getting are from other spam using you as the From address. Spam sent from your machine would have random addresses not necessarily your own. But you might still have a trojan running that could be used to send spam so you should check.

  3. Why? by Anonymous Coward · · Score: 3, Insightful

    What makes you think you're going to get delivery failures for outgoing spam? If you're a spam zombie, I doubt it is going out with your email in the from: field.

  4. eh by doofusclam · · Score: 2, Insightful

    Why not run a free firewall and watch for any alerts that something is trying to connect to the internet? Zonealarm will do fine.

    If you're a bit more techie you can use winpcap or similar to capture the traffic.

    There's no excuse to be wide open. You'll soon do something about it when your ISP wakes up to the problem and cuts you off. I appreciate how people can get caught inadvertantly by malware (I was hosting a trojan for a few hours last week inbetween upgrades) but I don't appreciate you leaving it this long, then asking slashdot when it's plainly obvious what you need to do.

    Cheers.

  5. You're not infected by oKtosiTe · · Score: 2, Interesting

    I've been having the same, and I know for a fact I'm not infected. This is just another worm.

    --
    It will happen.
  6. You should be fine. by FrenZon · · Score: 4, Informative

    Most likely your email address is getting used as the return address and little more - the returned mail thing affects everyone to some degree. If you were being used as a spam zombie, you'd probably not notice any change in returned mails, as the zombies generally use someone else's address again as the return addy. I'm fairly sure the return addresses aren't always randomised, as on my domains I see a bucketload of spam all from the same email address, so whoever lives there must be getting a bucketful of bounces.

    Still, you really should get an antivirus solution to ease your worries. I use AVG from Grisoft, which is available in a free edition.

    Of course, the bounces are plain annoying - when I get ACTUAL bounces from mail I send, I often delete them based on subject line, not realising that the person I was trying to contact is none the wiser. Booo

  7. ultimate firewall by cuiousyellow · · Score: 3, Funny

    The poster sounds like a good candidate for MJR's ultimately secure firewall.

    Try Zonealarm?

  8. OMG by cL0h · · Score: 2, Informative

    You're running Windows 98 with no virus software. I'm surprised you can use the machine at all. I constantly get requests from people to clean up their Win98 machines. They are usually riddled with spyware, trojans and diallers. Don't bother with new antivirus. Get a new operating system.

    --
    cL0h
    1. Re:OMG by Reene · · Score: 2, Interesting

      For a long time (5+ years) I ran Windows 98 because I couldn't get online under any other operating system (and I tried a lot of them) and couldn't afford a $60 dialup modem that would allow me to do so.

      For a large part of that time I ran no firewall, used an online remote virus scanner sporadically at best, and reinstalled only once. In all that time, my computer contracted only one virus (a non-serious one at that), and this was due to a less computer-savvy relation of mine browsing the internet using Internet Explorer while I was out of the house and unable to show her how to use Mozilla.

      So what is my motivation to say all this? There is a point that justified bias crosses the line into unjustified bias. Going online in Windows 98 without iron-clad virus protection and 3 firewalls does not guarantee the crippling of your computer to the point of being unable to use it if you know what you are doing. Now, undoubtedly the rules change when it comes to your "average" user, but even then it takes a relatively small tutorial in what not to do to keep them rather safe. I know this because it took me about 10 minutes to teach my 63 year old grandmother the basic (and most important) rules of going online without getting viruses or malicious dialers and the like and a friendly reminder every now and then when she forgets or gets confused.

      Of course now I use SuSE and I worry even less about that sort of thing now. I'm tempted to go back to using my Windows 98 partition to be honest, because I can't for the life of me get my HP scanner working (and as a quasi-professional artist this is a Bad Thing) and I've had several problems with keeping dialup working. Problems that I needless to say do not have in Windows.

      --
      "He does look a bit Oompa like, even if his Loompa is a bit off-kilter."
  9. maybe... by johnjones · · Score: 4, Informative

    ok if you run windows you need a virus checker

    are you a home user ?
    if so

    http://free.grisoft.com/freeweb.php/doc/2/

    and get avg for free
    Now you need a firewall

    http://www.free-firewall.org/

    then I would advice get rid of spyware with spybot
    donate something to the project if you like it...

    http://www.safer-networking.org/en/download/


    regards

    John Jones

  10. maybe not. by gl4ss · · Score: 3, Informative

    but if you're running a win98 without firewalling/serious tweaking.. ..you're probably owned or at least at risk. though in all fairness they're probably some other spammers who just happen to use your mail add as the sender.

    go with FREE solutions, they exist.

    http://www.free-av.com/ free virus scanning

    http://www.free-firewall.org/ some free firewalling

    --
    world was created 5 seconds before this post as it is.
    1. Re:maybe not. by mbourgon · · Score: 2, Insightful

      Why is he owned if he uses 98? My impression has been that 98 is _safer_ - WinNT/2k/XP all have all these fun services that can be exploited, where 98 doesn't. Granted, if you run IE or the like all bets are off.

      Or is there something I'm missing?

      --
      "Sometimes a woman is a kind of religion, she can save your soul & set you free from all your sins" - Bad Examples
  11. AVG AntiVirus by Green+Light · · Score: 3, Informative

    Here is the link to their free version This works well, and is completely free for personal use.

    --
    "Send an Instant Karma to me" - Yes
  12. AVAST by chadkiser · · Score: 4, Informative

    http://www.avast.com/eng/avast_4_home.html Home version is free

  13. We get the same thing all the time... by Anti_Climax · · Score: 2, Interesting

    We get bounces to the support address at the company I work at all the time. Someone has decided to use our support address as the 'from:' address in their crappy spam. Anytime they send it to a non-existant address, we get the bounce. Our system is updated and locked down, so they aren't coming from us, but YMMV.

    Either way, I'd suggest running that address through a spam block of some kind to filter out the crud or just give it up entirely if you can.

    --
    Even people that believe in pre-destiny look both ways before crossing the street.
  14. Yes by noselasd · · Score: 2, Informative

    antivir seems to work ok,
    and is updated afaik.
    Spyware removal software is obligatory on windwos as well.

  15. Re:Another stupid ask slashdot by feidaykin · · Score: 5, Insightful
    Elitist attitudes like this are always amusing to me... Requests for this guy to search google don't answer his question... He wants to know what we, a group of tech savvy folk, recommend. It's harder for google to answer that directly than a simple ask slashdot. To all the moaners out there, stop reading Ask Slashdot or just stop reading the site alltogether. Questions like these are how people learn, and serve as starting point for disscusion here.

    We should never insult folks for asking "stupid" questions, but rather admire the courage it took to ask.

    --

    "To confine our attention to terrestrial matters would be to limit the human spirit." -Stephen Hawking

  16. I don't get it.... by Apreche · · Score: 5, Insightful

    OK. I'm a dual booting guy. Obviously my linux, which I use mostly, has no problems. However, my windows install also has no problems. I only got a virus once ever because after a clean XP install a worm got to me before I got to windowsupdate.

    The point is that you do NOT need anti-virus software. Anti-virus anti-spyware software should be used only to cleanup already busted systems. Your system cannot be infected if you take proper care to prevent it. Even if you are running windows on a cable modem all day.

    1) NEVER download an e-mail attachment.
    2) Use Firefox instead of IE.
    3) Use Thunderbird instead of Outlook
    4) Do NOT visit untrustworthy websites
    5) Do NOT download any software from the internet and install it. Even if it looks trusty from tucows or download.com do a google search to see if it it spyware first.
    6) Have a firewall like zone alarm or sygate, or better have another computer between you and the net with a firewall on it. Or have a hardware firewall. Proper network level security keeps the worms out almost guaranteed.
    7) If you have wireless lock it down. You don't want a drive by person to start sending spam out your pipe.
    8) DO get all the windows updates that are security fixes. The ones that aren't security fixes you can choose to get or not get at your own discretion.

    If you do those things then there is almost no way you can get hit. It's really that simple. And if you DO get hit, its usually easier to re-install due to the degrading nature of windows. Any windows install, even a clean one, falls apart over time. The registry fills with more and more junk. Improperly uninstalled apps leave files behind here and there. Hidden variables change and are not changed back. Even the cleanest installs seem to last at most 18 to 24 months except in very controlled business environments.

    Dont pay for anti-virus software, its a ripoff. Just re-install and then take proper preventative measures so it doesn't happen again.

    --
    The GeekNights podcast is going strong. Listen!
    1. Re:I don't get it.... by R2.0 · · Score: 5, Insightful

      "Microsoft have released three (3!) major desktop operating system revisions since then"

      Windows ME: Oh, it was major, alright - a major failure. The "Upgrade" path at the time was to revert Back to 98SE.

      Windows 2000: Remember, this was marketed as "not for home use". That was what ME was for. 2000 wouldn't support many legacy apps.

      So there has really only been 1 major desktop OS revision that is relevant, and given XP's poor rep, there are plenty of reasons not to upgrade.

      Also, the comparison between then and now isn't valid. A large number of the exploits now target services in 2000 & XP that 98 doesn't have.

      98 certainly isn't state of the art, but I don't know that I'd call 2000 or XP that either. Your most compelling argument seems to be "98 is OLD!!"

      BFD.

      --
      "As God is my witness, I thought turkeys could fly." A. Carlson
    2. Re:I don't get it.... by Godeke · · Score: 2, Interesting

      Insufficient. If you hook Windows directly up to broadband to get WindowsUpdate running, you have a good chance of being infected before you are patched. Software firewalls don't block everything, so Step 6 is insufficient, unless you have a machine proxying, NATting firewall or a true firewall. Even then you put a vulnerable machine on your local network, which may have unpleasant surprises in store for you.

      A better option is for step 8 becomes: get all windows updates and security fixes ON CD, because otherwise you expose your machine prior lockdown. Likewise, turn off unneeded services (you don't need to be sharing files and printers, why the heck would you leave the SMB server running?) prior to connecting to a network.

      Yet, even with all that you end up with the problem of vulnerabilities that are not patched prior to the exploit being generally available. Yes, using alternate programs and avoiding untrustworthy websties sounds good, until you make a typo and end up at an untrustworthy site by accident. (Or shall we decree the typo a death penalty offense). I recently saw a typo site trying to exploit the Firefox 1.9.2 vulnerability to install adware (which didn't work since I was on Linux as I am right now, but they tried...)

      In the end, perhaps having a virus scanner in memory to detect things that get through all your other work might be wise. Otherwise that high and mighty "almost no way you can get hit" will bite you back when the almost part comes true and you don't even know it happened. Remember: security is about defense in depth and a big ego provides little depth.

      I personally don't care for anti-virus software (it is a little late in the cycle for my taste), but to avoid using it on the corporate networks I care for would be gross negligence on my part, opening me up to potential legal liability. Suddenly $22 a machine a year looks pretty good, even as I take all the other steps to avoid needing it in the first place.

      --
      Sig under construction since 1998.
  17. Free virus software is out there. by ScepticOne · · Score: 2, Informative

    http://www.clamwin.net/ is an allegedly good antivirus program.

    Also, http://www.spybot.info/ has been alleged to be a good antispyware program.

  18. Most likely a 'Joe-Job'...Ask your ISP about SPF by rthille · · Score: 5, Informative

    Since the SMTP protocol doesn't have any authentication of the sender (except within an ISP/Domain with SMTP-AUTH), it's easy for a spammer/virus to send mail pretending to be you. That's called a 'joe-job' after one of the early occurrences of it.
    A recently proposed solution (though not without it's problems) is SPF (Sender Policy Framework) http://spf.pobox.com/ where a domain owner can publish the list of servers which are authorized to send mail as being from a user of their domain.
    Until it's widely deployed, not just on the publishing side, but on the checking side, it won't be real useful. However it's nearly trivial for the DNS owner to publish the records and since big ISPs like AOL and Yahoo are starting to check them it does protect you from being Joe-Jobbed to a large number of mailboxes.

    --
    Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
  19. Housecall by jgaynor · · Score: 2, Interesting

    Bah. Im suprised no one has mentioned housecall yet:

    http://housecall.antivirus.com

    Housecall is a web-based virus scanner that, since it is loaded anew every time, always has the latest virus definitions. Since it installs nothing but temporary cache files, you dont have to worry about it slowing down your machine.

    Because of the nature of the application it can't always clean the offending virii/malware, but it will at least alert you to their presence and give you their names so that you can manually remove them. When combined with stinger, spybot and google it's an excellent choice for on-site calls to machines without AV or for your old boxen that just cant afford the extra cycles for full-time AV bloat.

    If you prefer to do the offline thing, try the Knoppix anti-virus distribution (weak link I know). Once again it isn't a permanently installed application and since the OS isn't running it can slap down bugs before they're loaded into memory.

    Cheers!

    1. Re:Housecall by Anonymous Coward · · Score: 2, Interesting

      (Posting AC so I don't undo my mods)

      I've used housecall a few times to scan some machines. I works pretty well, and since it's web based you don't have to install anything. The downside is that it's for IE only so it may not be an option for some (hopefully many).

      For offline scanning, I'll repeat the numerous recommendations for Grisoft's AVG free scanner
      http://www.grisoft.com/us/us_index.php
      A fter testing it on a few machines, were planning to purchase the server edition to scan all incoming email before it even hits the inbox.

  20. Almost right by Mycroft_514 · · Score: 2, Interesting

    Except for the part about degradation of the registry. Look, I've got systems that are running Win 98SE and even 2 still running Win 95.

    One of the Win 95 machines has been running for 7 YEARS without having to reload the OS. I have swapped hardware in and out, and changed drivers. The last time the OS was changed was when I put the 6 Gig drive in (1997) and I needed to upgrade from Win 95 ver B to ver C (B didn't support drives that big).

    One of the Win 98 machines is now 4 years old, with no reloads, the other is only about 18 months old.

    I run them all now on a router with a hardware firewall. The 95 machine is hardwired, the 98's are Wi-fi. Cable modem coming out the other end. There is NO anti-virus software installed, though adaware still runs on them every so often. I did install all the patches from MS.

    Oh, and one more item of security for your Wi-fi system. Put passwords on your disk drives. You can teach all the other machines in your network to remember the passwords, but joe drive by can not access the drives if he breaks thru the first layer of security. Like anything else, he will go somewhere else where it is easier to get thru.

  21. You are being irresponsible by Bob+Cat+-+NYMPHS · · Score: 2, Informative

    You are doing nothing to stop your PC from being abused because you can't find free as in beer software?

    Adaware SE Personal www.lavasoft.de
    Zone Alarm Firewall www.zonelabs.com
    F-Prot Antivirus www.f-prot.com

    All commercial products free for personal use.

    Now, install those and stop the spammers, please.
    Keep your definitions updated, okay?

    --
    The latest Slashdot meme.
  22. No anti-virus software? Then stay off the net! by fmaxwell · · Score: 2, Insightful

    I run a Windows 98 laptop, sometimes wirelessly connected to broadband (a few hours a day, on average), but I had to remove my virus software years ago because it was locking my system up, so I'm wide open. I've tried to be a good citizen and have been shopping for new virus software, but prices are running $40-$70, and most of these are just for upgrades (not even counting the mandatory 'subscriptions')!

    If you have a Windows 98 machine with no anti-virus software, then stay off of the Internet. Period. You have no right to endanger and inconvenience others just because you're too cheap/poor to buy anti-virus software and too computer-illiterate to type "free antivirus software" into Google (hint).

    It reminds me of someone with 20/200 vision operating a car without glasses because glasses cost too much. "Oops! Sorry about your poodle! Didn't mean to run over your kid; sorry. Uh oh, hit another parked car."

  23. Not necessarily by renehollan · · Score: 3, Informative
    While running Win98 naked is about as wise as, well, running naked, this may not be the source of those bounce messages. IOW, by themselves they do not indicate that your box is a spam zombie.

    I get boatloads of these things, as well as spam (filtering is your friend) -- my email address is fairly public and in a lot of address books. I'm not about to abandon it as it's within a domain I lease.

    I run behind a fairly hardened firewall, and am moving towared a Linux iptables-based firewall/router/home server.

    What ticks me off is when such a message bounce indicates that the original message contained a virus. How dare someone accuse me of sending a virus just because their mail daemon received a spoofed From: header? They could at least check the route the mail took against that header to get an idea if it's bogus. But, often automatic smam/virus filters are pretty stupid and trust the From: address. Still, I wonder if someone, somewhere, "out there" is blacklisting me because someone else forged my identity. Sounds like a defamation suit if I could find the bastards.

    And that's the rub. Often when I've received such bounces, when the originator can be identified, they refuse to help in providing a copy of the original email, headers intact, that might permit tracking down the source: either a spammer, or a spam-zombie. I wonder if I could sucessfully file "theft of computer services" charges against such an organization: they're sending me unsolicited bounces, and furthermore, refusing to backup the allegation that they're bouncing messages from me. I wonder if the anti-spam legislation that's out there can be used as a club against those who send bounces to spoofed From: addresses and refuse to acknowledge or correct their mistake.

    --
    You could've hired me.
  24. Re:Early retirement by theonetruekeebler · · Score: 2, Insightful

    Dude, Given my current valid/invalid ratio is below .01 already, any mail bombs will just be bouncing the rubble.

    --
    This is not my sandwich.
  25. Basic PC Meds. All free. by slappyjack · · Score: 2, Informative

    I've found the following helpful for the no-budget set:

    Avast Home Edition Virus Scanner

    Spybot Search and Destroy

    HijackTHIS - Find out whats in your PC. (semi-advanced)
    The site for HiJackThis seems to be down for now. THere are a few other little nifty freebie aps in there, too. Heres a mirror download site

    AdAware - picks up a lot of crap in your PC

    (Anyone wanna offer up a few opinions on this stuff? You know you do.)

    Of course, the obligatory comment of "Use Mozilla, keep your shit patched, don't click every OK button you see" still applies.

    --
    s'wut i sed.
  26. dshield by j1m+5n0w · · Score: 2, Informative
    It's also a good idea to look you ip up on dshield. They aggregate firewall logs from many sources. If your IP is causing someone trouble, it is likely to show up there. Another similar service is mynetwatchman.

    -jim