My email keep sending out virus

[yungman]

I have problem with my email keep sending out email with virus to others. I have change password a few times and it did not help at all. I have Norton 360 already and that does not seems to help. What can I do to fix it?

It is a very new computer in service for about a month only and I have been careful not to open any suspicious emails.

Thanks

 

[Borek]

Are you sure it is YOUR computer sending these emails? Sender email can be easily faked.

Are you sure your email account is not hacked? It is not clear what password you have changed.

 

[yungman]

Are you sure it is YOUR computer sending these emails? Sender email can be easily faked.

Are you sure your email account is not hacked? It is not clear what password you have changed.

My stepson told me he received email that's suspicious from me. That happened after I change the password the second time.

The password is my email account password.

I am not sure about whether my email account got hacked, how do I check it? The email account was created in the old computer and it had problem before. This is a new computer and is working perfect perfect otherwise. I just sign in the email account with the new computer.

 

[SteamKing]

You've probably had your old e-mail account infected with a virus. The virus doesn't need to know your e-mail password to propagate; the password is there so only you can read your email.

The virus apparently lies dormant in your system until you receive/send e-mails. Certain viruses propagate by reading your contact log/address book and getting the e-mail addresses stored there. The virus can either create and send the suspicious messages, in the hope that some unwary person will open the email and infect his computer, or it can piggy-back onto one of your legitimate messages.

Changing your e-mail password will not disinfect your system. You need to have a good anti-virus program go thru your system and check for viruses. If your e-mail provided doesn't scan incoming/outgoing messages for viruses, you should probably consider changing to a provider with this feature.

 

[Borek]

You email account is not on your computer.

Email that you send is "put" by your email client on the server where you account is. This server connects to other servers, where other people account are, and sends emails there. Whenever someone else sends an email to you the same happens, just they connect to their server and their server sends the email to your server. When you click on "check mail" you program connects to the server and fetches all emails that were delivered in the meantime.

Best thing is to check headers of these emails your stepson received, they should contain information about where did the email originated from. Checking headers is typically one of the options available when viewing the email, but how it is done depends on the particular email client.

Another thing to consider: compare the emails that your stepson received (and thinks they are suspicious) with the ones you have sent. Could be everything is OK, they are just flagged as suspicious by oversensitive antispam/antivirus program. Happens all the time. Doesn't mean to be not vigilant, just not every alarm is real.

 

[yungman]

You email account is not on your computer.

Email that you send is "put" by your email client on the server where you account is. This server connects to other servers, where other people account are, and sends emails there. Whenever someone else sends an email to you the same happens, just they connect to their server and their server sends the email to your server. When you click on "check mail" you program connects to the server and fetches all emails that were delivered in the meantime.

Best thing is to check headers of these emails your stepson received, they should contain information about where did the email originated from. Checking headers is typically one of the options available when viewing the email, but how it is done depends on the particular email client.

Another thing to consider: compare the emails that your stepson received (and thinks they are suspicious) with the ones you have sent. Could be everything is OK, they are just flagged as suspicious by oversensitive antispam/antivirus program. Happens all the time. Doesn't mean to be not vigilant, just not every alarm is real.

Thanks for the reply, he called to confirm that we did not sent that email.

So if the email account is infected in the server, what can I do to fix it. Doesn't sound like any anti virus program in my computer is going to do any good.

 

[yungman]

You've probably had your old e-mail account infected with a virus. The virus doesn't need to know your e-mail password to propagate; the password is there so only you can read your email.

The virus apparently lies dormant in your system until you receive/send e-mails. Certain viruses propagate by reading your contact log/address book and getting the e-mail addresses stored there. The virus can either create and send the suspicious messages, in the hope that some unwary person will open the email and infect his computer, or it can piggy-back onto one of your legitimate messages.

Changing your e-mail password will not disinfect your system. You need to have a good anti-virus program go thru your system and check for viruses. If your e-mail provided doesn't scan incoming/outgoing messages for viruses, you should probably consider changing to a provider with this feature.

That's what I thought that the virus is dormant in the computer, but this is a very new computer and I definitely did not open any suspicious email yet. It feels like it stayed with the email account.

I have Norton 360 which seems to be a whole lot better than McAfee. Also, I have two email account, one for business and one for personal use, it's only the personal used one that is infected.

 

[Borek]

As I wrote before: without checking headers you can't still know if the email was sent from your account. Not that it is very likely, but it still can't be ruled out.

The password is my email account password.

What email program do you use? Do you use it for both email accounts?

Can your stepson check what virus was detected in the email from you?

 

[yungman]

As I wrote before: without checking headers you can't still know if the email was sent from your account. Not that it is very likely, but it still can't be ruled out.



What email program do you use? Do you use it for both email accounts?

Can your stepson check what virus was detected in the email from you?

How do you check the headers?

I have to ask him. My email is Hotmail @live.com.

Thanks

 

[Borek]

How do you check the headers?

As I wrote earlier - it depends on the mail program he uses.

Typically you can select what is shown in some kind of a View menu, or in s local menu that shows after clicking displayed post with a right click.

 

[ViperSRT3g]

It sounds as though it may be a spoofed email being sent to your stepson and made to look like it's coming from you.

 

[yungman]

As I wrote earlier - it depends on the mail program he uses.

Typically you can select what is shown in some kind of a View menu, or in s local menu that shows after clicking displayed post with a right click.

Sounds like all of you here suspect the problem is on my stepson's side, not on my side! Right?

I did some experiment and I find the Header. I just go to the inbox and right click on the email and choose "Show full header".

For example, is it under:

Return-Path: <orders@weberorders.com>

This will show who actually sent the email? In this case the email is from <orders@weberorders.com> which is vaild. I should have my stepson read the full header on his computer to verify it's from us?

If that's the case, then all he need to do is to put email address as spam?

Thanks

 

[Routaran]

The return path is just the reply to address. This can be altered to be anything by the sender. Take a look at the mail servers listed in the header, they are much more informative.
If the email came from your computer, your ISP's mail servers should be listed within the header also because the email would go from your system to your ISP's mail server before being sent to the destination.

Take a closer look at all the hostnames listed and see if you anything sticks out. If it's spam the sending server could be something really odd like a server from Russia or China (.ru or .cn address) Basically something that is not your ISP.

If you feel comfortable, you can post the header information here but keep in mind there may be personally identifiable information if it actually did come from your system.

 

[AlephZero]

This is what a spoof email header looks like:

To: <personal information deleted>
Subject: You have received a tax refund payment
X-PHP-Originating-Script: 10002:mailer.php
From: HM Revenue & Customs <service@paypal.co.uk>
Reply-To: 
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <20140421074824.30855116D180@mail.imagix.fr>
... etc

it claims to be from the UK tax authorities, but the email address says "paypal", and it was actually sent from somewhere in France.

You may have sent an email sometime in the past to someone whose computer was infected with a virus, that collected the contents of their address book. That's one way that email fraudsters get "real" email addresses, to send out fake messages that appear to come from somebody you know, so you are more likely to open them.

 

[yungman]

The return path is just the reply to address. This can be altered to be anything by the sender. Take a look at the mail servers listed in the header, they are much more informative.
If the email came from your computer, your ISP's mail servers should be listed within the header also because the email would go from your system to your ISP's mail server before being sent to the destination.

Take a closer look at all the hostnames listed and see if you anything sticks out. If it's spam the sending server could be something really odd like a server from Russia or China (.ru or .cn address) Basically something that is not your ISP.

If you feel comfortable, you can post the header information here but keep in mind there may be personally identifiable information if it actually did come from your system.

This is extracted from one of my old email account. I deleted out things that did not make sense and change some numbers. Can you tell me what to look for?


From PreSonus Audio Electronics Mon Jun 9 13:01:33 2014
X-Apparently-To: alanchan@yahoo.com via 12.34.567.890; Mon, 09 Jun 2014 20:01:35 +0000
Return-Path: <support@presonus.zendesk.com>
Received-SPF: pass (domain of presonus.zendesk.com designates 123.124.47.3 as permitted sender)


X-Originating-IP:
Authentication-Results:
Received: from 127.0.0.1 (EHLO out1.pod2.sac1.zdsys.com) (123.124.47.3)
by mta1535.mail.ne1.yahoo.com with SMTPS; Mon, 09 Jun 2014 20:01:34 +0000
Received: from zendesk.com (work2.pod2.sac1.zdsys.com [32.45.3.6])
by out1.pod2.sac1.zdsys.com (Postfix) with ESMTP id AB88B780031
for <alanchan@yahoo.com>; Mon, 9 Jun 2014 20:01:33 +0000 (UTC)
From: PreSonus Audio Electronics <support@presonus.zendesk.com>
Reply-To: PreSonus Audio Electronics <support+id186630@presonus.zendesk.com>
To: Me <alanchan@yahoo.com>
Message-ID: <Z9N1S1G3_5396129d43c15_eee3fd05c0b340490107f_sprut@zendesk.com>
In-Reply-To: <Z9N1S1G3@zendesk.com>
Subject: [PreSonus Audio Electronics] Pending request: Program cannot locate
the sound files.
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="--==_mimepart_675679da4ae0_eee5fd08c0b192735a6";
charset=utf-8
Content-Transfer-Encoding: 7bit
Auto-Submitted: auto-generated
X-Mailer: Zendesk Mailer
X-Delivery-Context:
Content-Length: 12698

 

[Routaran]

Return-Path: <support@presonus.zendesk.com>
Received-SPF: pass (domain of presonus.zendesk.com designates 123.124.47.3 as permitted sender)

This first bit is a good indicator. The SPF (Sender Policy Framework) is a basic check that the mail is not spoofed. In this case, it's coming from where it's supposed to be coming from, it got a pass.

Received: from 127.0.0.1 (EHLO out1.pod2.sac1.zdsys.com) (123.124.47.3)
by mta1535.mail.ne1.yahoo.com with SMTPS; Mon, 09 Jun 2014 20:01:34 +0000
Received: from zendesk.com (work2.pod2.sac1.zdsys.com [32.45.3.6])
by out1.pod2.sac1.zdsys.com (Postfix) with ESMTP id AB88B780031
for <alanchan@yahoo.com>; Mon, 9 Jun 2014 20:01:33 +0000 (UTC)

This part here is the path the email took to get to you. This also looks legit, i did a google search and zdsys.com appears to be zendesk
This email came from out1.pod2.sac1.zdsys.com and arrived at a Yahoo mail server mta1535.mail.ne1.yahoo.com
The return address says zendesk, the mail came through a zendesk server. Someone else isn't faking it, its actually coming from where the mail says it's from.

From: PreSonus Audio Electronics <support@presonus.zendesk.com>
Reply-To: PreSonus Audio Electronics <support+id186630@presonus.zendesk.com>
To: Me <alanchan@yahoo.com>
Message-ID: <Z9N1S1G3_5396129d43c15_eee3fd05c0b340490107f_sprut@zendesk.com>
In-Reply-To: <Z9N1S1G3@zendesk.com>
Subject: [PreSonus Audio Electronics] Pending request: Program cannot locate
the sound files.
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="--==_mimepart_675679da4ae0_eee5fd08c0b192735a6";
charset=utf-8
Content-Transfer-Encoding: 7bit
Auto-Submitted: auto-generated
X-Mailer: Zendesk Mailer
X-Delivery-Context:
Content-Length: 12698

All of this stuff doesn't matter too too much. Depending on circumstances, the Message-ID may be useful but the rest of it you can programatically changed when you're sending the email.

So from the information above, I would be confident in claiming that the email message actually came from the source that the message claims to be from.
Now with the spam mail in question, you'll need to check to see if it actually came from your system in a similar manner. If it did, then there's a chance that your computer is infected and is sending out spam to your contact list.
But if it turns out that the mail didn't come from your system/network/ISP, then just tell the person that got it to delete it without opening any attachments. That's all that you can do.

 

[yungman]

This is what a spoof email header looks like:

To: <personal information deleted>
Subject: You have received a tax refund payment
X-PHP-Originating-Script: 10002:mailer.php
[B]From: HM Revenue & Customs <service@paypal.co.uk>[/B]
[SIZE="4"]Is this where it said from paypal of uk
Reply-To: 


MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
[B]Message-Id[/B]: <20140421074824.30855116D180@mail.imagix.[B][SIZE="5"]fr[/B]>
... etc

Is this where it tell you the message is from France?


it claims to be from the UK tax authorities, but the email address says "paypal", and it was actually sent from somewhere in France.

You may have sent an email sometime in the past to someone whose computer was infected with a virus, that collected the contents of their address book. That's one way that email fraudsters get "real" email addresses, to send out fake messages that appear to come from somebody you know, so you are more likely to open them.

Thanks for your example.

1)Is the last two characters tell you what country it comes from?

2) So I should compare the "From" to the "Message ID" to see whether there is inconsistency?

3) What if they all from US? Do I compare "20140421074824.30855116D180@mail.imagix" in the "Message ID" with " HM Revenue & Customs <service@paypal.co.uk>" in the "From"?

Any other hint?

Thanks for your help.

 

[Routaran]

1) Yes, the last bit of a hostname tells you where the address is from. In the example that AlephZero presented, the From field was service@paypal.co.uk
anything.co.uk means this address is from the United Kingdom.
google.ca means the address is from Canada
.ru is Russia, .fr is France, .in is India, etc.
It's an easy way to identify where the address is located.

2) This email claims it's from the United Kingdom (the From field) but the Message ID shows that the message in fact originated in France. Someone deliberately changed the From address. This is a very good indication that something fishy is going on.

3) The first part of the message ID (before the @) is usually just a timestamp. in the example:
20140421074824.30855116D180@mail.imagix.fr

20140421074824 is:
Year 2014
Month 04
Day 21
Hour: 07
Min: 48
Sec: 24

I don't know what the 2nd part(.30855116D180) the server added was. The important bit is the stuff after the @ sign as it is the domain that the sending server belongs to. This will let you know more about the origin of the message.

 

[yungman]

So back to using my example:

From PreSonus Audio Electronics Mon Jun 9 13:01:33 2014
X-Apparently-To: ******@yahoo.com via 12.34.567.890; Mon, 09 Jun 2014 20:01:35 +0000
Return-Path: <support@presonus.zendesk.com>
Received-SPF: pass (domain of presonus.zendesk.com designates 123.124.47.3 as permitted sender)

X-Originating-IP:
Authentication-Results:
Received: from 127.0.0.1 (EHLO out1.pod2.sac1.zdsys.com) (123.124.47.3)
by mta1535.mail.ne1.yahoo.com with SMTPS; Mon, 09 Jun 2014 20:01:34 +0000
Received: from zendesk.com (work2.pod2.sac1.zdsys.com [32.45.3.6])
by out1.pod2.sac1.zdsys.com (Postfix) with ESMTP id AB88B780031
for <******@yahoo.com>; Mon, 9 Jun 2014 20:01:33 +0000 (UTC)
From: PreSonus Audio Electronics <support@presonus.zendesk.com>
Reply-To: PreSonus Audio Electronics <support+id186630@presonus.zendesk.com>
To: Me <******@yahoo.com>
Message-ID: <Z9N1S1G3_5396129d43c15_eee3fd05c0b340490107f_sprut@zendesk.com>
In-Reply-To: <Z9N1S1G3@zendesk.com>

So that's the two lines to compare? I don't see what country it comes from. I know they are from us.

Thanks

 

[yungman]

I am trying to learn. This is from att.net. It is different. This is a legitimate email. What do I look for? From Weber Orders Desk Fri Jun 13 09:47:28 2014
X-Apparently-To: *****@yahoo.com via 12.345.768.566; Fri, 13 Jun 2014 16:47:35 +0000
Return-Path: <orders@weberorders.com>
Received-SPF: neutral ( 246.345.21.90 is neither permitted nor denied by domain of weberorders.com)


X-Originating-IP: [246.345.21.90]
Authentication-Results: mta1024.sbc.mail.ne1.yahoo.com from=weberorders.com; domainkeys=neutral (no sig); from=weberorders.com; dkim=pass (ok)
Received: from 246.0.0.1(HELO qproxy1-pub.mail.unifiedlayer.com) (EHLO mta1024.sbc.mail.ne1.yahoo.com) (246.345.21.90)
by mta1024.sbc.mail.ne1.yahoo.com with SMTP; Fri, 13 Jun 2014 16:47:34 +0000
Received: (qmail 22416 invoked by uid 0); 13 Jun 2014 16:47:34 -0000
Received: from unknown (HELO cmgw3) (10.0.90.84)
by qproxy1.mail.unifiedlayer.com with SMTP; 13 Jun 2014 16:47:34 -0000
Received: from host118.hostmonster.com ([74.220.207.118])
by cmgw3 with
id DsnX1o0032ZoPqa01sna6j; Fri, 13 Jun 2014 10:47:34 -0600
Received: from localhost ([246.0.0.1]:47108 helo=host118.hostmonster.com)
by host118.hostmonster.com with esmtp (Exim 4.82)
(envelope-from <orders@weberorders.com>)
id 1WvUdW-0008Nk-TF
for ]*****@yahoo.com; Fri, 13 Jun 2014 10:47:30 -0600
Date: Fri, 13 Jun 2014 10:47:28 -0600
To: Alan < ]*****@yahoo.com >
X-Autorespond: Re: Weber Speakers Order # 70560
MIME-Version: 1.0
X-Loop: Alan < ]*****@yahoo.com >
Precedence: auto_reply
X-Precedence: auto_reply
From: "Weber Orders Desk" <orders@weberorders.com>
Content-type: text/html; charset=utf-8
Subject: Your order / email to Weber
X-Identified-User: {:host118.hostmonster.com:weberord:weberorders.com} {sentby:program running on server}
Content-Length: 694

Can you tell me what to look for? Where do you learn all these, any book or link you can suggest?

Thanks

 

[Borek]

Is the last two characters tell you what country it comes from?

In theory - yes. In reality - often yes, sometimes not. All it tells is where the domain was registered, it doesn't tell anything about where the server is nor who owns it. These days you can register your domain in almost any country with just a few clicks.

Edit: beware, while posting headers you have posted your email addresses, you don't want to do that. Edited them out (replaced with *****), I hope I have not missed anything.

 

[yungman]

In theory - yes. In reality - often yes, sometimes not. All it tells is where the domain was registered, it doesn't tell anything about where the server is nor who owns it. These days you can register your domain in almost any country with just a few clicks.

Edit: beware, while posting headers you have posted your email addresses, you don't want to do that. Edited them out (replaced with *****), I hope I have not missed anything.

Thanks, I actually change the email address already.

 

[Borek]

Ah, OK. Still, as long as you change it to something that is quite likely to be a real address, you may be doing a disservice to the original owner.

 

[Routaran]

.com addresses are almost all located in the US. The reason they are not .us is because those sites were the first on the scene. They didn't need to identify they were from the US, all of them were from the US. Kind of like the UK post office, they don't specify their name because they were the first post office. Every other country needs to say it's name.

From: PreSonus Audio Electronics <support@presonus.zendesk.com>
Message-ID: <Z9N1S1G3_5396129d43c15_eee3fd05c0b340490107f_sprut@zendesk.com>

The from field says it's from @presonus.zendesk.com
The MessageID (server says) it came from a @zendesk.com system. I'd be confident based on that the email came from where it says it came from


Basically, this is what you need to do when you suspect an email is phishing or scam. The contents of the email will be your first clue. Check the links, often the text is different from the actual link specified.
Google the domain names listed to see who/what they are, if they have a website, etc.
In this header we have:
weberorders.com
hostmonster.com
unifiedlayer.com
yahoo.com

Weberorders are a Speaker Sales
Hostmonster is one of the domains the mail went through
same for unifiedlayer and finally arrived at yahoo.

Since this is a commercial website, it's possible that the website was registered through the hostmonster service, they offer webspace and email services.

Do a Whois on the domain names to see if it's registered by an actual company or just some random person. A couple searches gave me this
http://whois.domaintools.com/tedweber.com
http://who.is/domain-history/tedweber.com

The website info matches what the email says (your subject line was Re: Weber Speakers Order # 70560)

But there is one thing that I thought was very strange
X-Originating-IP: [246.345.21.90]
Received: from 246.0.0.1(HELO qproxy1-pub.mail.unifiedlayer.com) (EHLO mta1024.sbc.mail.ne1.yahoo.com) (246.345.21.90)

This is not a valid IP address, the 2nd octet is 345. I'm assuming you changed this. Otherwise I don't know what's going on with this.

 

[Borg]

Here's a site that will help you. On the home page, there's a link to help you trace where an email came from.

http://whatismyipaddress.com/

If you just have the name and don't know the IP Address, you can figure it out by pinging the server. Open a command prompt and type something like this:

ping www.cnn.com

The numbers that come back are the IP Address.

 

[Borek]

.com addresses are almost all located in the US

I strongly doubt. Do you have any stats that could confirm that?

 

[yungman]

Here's a site that will help you. On the home page, there's a link to help you trace where an email came from.

http://whatismyipaddress.com/

If you just have the name and don't know the IP Address, you can figure it out by pinging the server. Open a command prompt and type something like this:

ping www.cnn.com

The numbers that come back are the IP Address.

Thanks for the info. How do I ping www.cnn.com? I clicked it and it just open the CNN page.

 

[Borg]

Thanks for the info. How do I ping www.cnn.com? I clicked it and it just open the CNN page.

The forum's web page is automatically creating a link.
Open the Start menu and type cmd in the search box. You should get something like cmd.exe. Open that and type the command:
ping cnn.com

 

[AlephZero]

.com addresses are almost all located in the US. The reason they are not .us is because those sites were the first on the scene.

.com was a global top level domain for commercial companies. Globally, there are now more than twice as many .net domain names as .com.

The ".us" country-specific top level domain was one of the first three registered in 1985 (the others were the UK and Israel) but for whatever reason US websites don't seem to want to advertise their country of origin. There are fewer USA-specific domain names than for countries like Greece, Romania, and Egypt. There are more US military (.mil) domain names than .us. http://ftp.isc.org/www/survey/reports/current/bynum.txt.

It seems hard to find much data on the geographical distribution of global names like .com without paying for it, but http://royal.pingdom.com/2010/07/09/the-massive-dominance-of-com-charts/ has something comparing the US with the whole of the web.

 

[Routaran]

.com addresses are almost all located in the US.

Yeah, I think I overstepped my bounds by stating that as a fact, it's not. I do not know for sure or have any hard data indicating that is the case. It's only my opinion based entirely on the US being the first country on the scene with the www and people mostly going with .com for anything commercial

 

[yungman]

But there is one thing that I thought was very strange
X-Originating-IP: [246.345.21.90]
Received: from 246.0.0.1(HELO qproxy1-pub.mail.unifiedlayer.com) (EHLO mta1024.sbc.mail.ne1.yahoo.com) (246.345.21.90)

This is not a valid IP address, the 2nd octet is 345. I'm assuming you changed this. Otherwise I don't know what's going on with this.

Yes, I change to some random numbers.

Thanks for you detail explanation, I spend some time on it and try the Whois also.

So:

1) "From" is what the email claimed it's from.
2)"MessageID" is the server think where it comes from.
3) Domain name is "****.com"

If the two match, then it is good.

But if in doubt, use Whois to check whether the email address ( domain name) is legit.

thanks

 

[yungman]

The forum's web page is automatically creating a link.
Open the Start menu and type cmd in the search box. You should get something like cmd.exe. Open that and type the command:
ping cnn.com

I just got my Win 8.1 laptop, how do I get the Start menu?

Thanks

 

[yungman]

I want to sum up what I learn here and see whether this is good enough:

(A)

From: PreSonus Audio Electronics <support@presonus.zendesk.com>
The “From” field is what the email say it is from.
The “MessageID” is what the server say the email comes from.

If the two match, it is a good sign. To be safe ,use Whois to check the domain name.
http://whois.domaintools.com
http://who.is/domain-history


(B)

Return-Path: <support@presonus.zendesk.com>
Received-SPF: pass (domain of presonus.zendesk.com designates 123.124.47.3 as permitted sender)

The SPF (Sender Policy Framework) is a basic check that the mail is not spoofed.
If domain from “Return-Path” match “Received-SPF”, That is also a good indication.

 

[Borg]

I just got my Win 8.1 laptop, how do I get the Start menu?

Thanks

I don't have Windows 8 but Google returned this:
How to open the Command Prompt in Windows 8

 

[Routaran]

I want to sum up what I learn here and see whether this is good enough:

(A)

From: PreSonus Audio Electronics <support@presonus.zendesk.com>
The “From” field is what the email say it is from.
The “MessageID” is what the server say the email comes from.

If the two match, it is a good sign. To be safe ,use Whois to check the domain name.
http://whois.domaintools.com
http://who.is/domain-history


(B)

Return-Path: <support@presonus.zendesk.com>
Received-SPF: pass (domain of presonus.zendesk.com designates 123.124.47.3 as permitted sender)

The SPF (Sender Policy Framework) is a basic check that the mail is not spoofed.
If domain from “Return-Path” match “Received-SPF”, That is also a good indication.

Remember, all this does is check if the mail comes from where it claims it comes from. It doesn't mean it's safe.

If the mail doesn't come from where it claims then it's usually not safe.
But if the mail says it comes from (Return Path) infectme@DrEvilVirusFactory.com
and the SPF also says anEvilMailServer.DrEvilVirusFactory.com you still don't want to open it because it will unleash a computer virus that can, amazingly, rewrite your DNA by just looking at it.

Kinda like a bottle of milk that's open and just sitting on the counter, absolutely don't just start drinking.
And even if it's sealed, you still check to see if it's safe first.
Same principle, just because the SPF comes back okay, doesn't mean the contents are safe, you still need to check who it's actually from and if it's normal traffic or something you were expecting.

I just got my Win 8.1 laptop, how do I get the Start menu?

Thanks

https://www.yahoo.com/tech/how-to-get-the-real-start-menu-back-in-windows-8-or-8-1-82641957972.html

You should have a watered down version of the Start button in desktop mode already if you are running 8.1
If you don't then verify that you actually have 8.1 and not 8.0

MS is supposed to be releasing a newer start menu button with more bells and whistles through a patch but I don;t know the details of when. I'm still running Win7 so my information is limited.

 

[yungman]

Thanks everyone for helping. I sure learn a lot.

Where do you get all these informations, is there any books or trusted link that you can suggest? I would like to learn more about internet security.

Thanks

 

[Routaran]

I'm not sure exactly where I learned this from, just IT experience and google I think, probably mostly google what something was and read.

Like what the message-id field in an email is
Google 'messageid email' and see what turns up.

 

[yungman]

I think my computer or server is infected. I just received another email from our insurance company that we sent them a suspicious email and it's from: juangalli@fibertel.com.ar

What can I do to fix this?

Thanks

Alan

 

[Borg]

I think my computer or server is infected. I just received another email from our insurance company that we sent them a suspicious email and it's from: juangalli@fibertel.com.ar

What can I do to fix this?

Thanks

Alan

At this point, I would recommend installing a firewall and think twice before letting any program have internet access of any kind. Until you're used to it, don't give blanket access to any program. It will be annoying at first because the firewall will pop up continuously asking if it should let programs connect to the internet. When the firewall pops up, google the program to see what it is before you accept it. If the first set of hits says it's a virus, it probably is. Once you know what virus you have, you can work on getting rid of it.

You will be surprised by how many programs try to connect all the time even though most of them don't need to get to the internet to run. Usually, they're just connecting to see if they should update themselves. I've been using a free version of ZoneAlarm for years and it has served me well. It never ceases to amaze me how often programs will try multiple ways of getting internet access.

 

[yungman]

At this point, I would recommend installing a firewall and think twice before letting any program have internet access of any kind. Until you're used to it, don't give blanket access to any program. It will be annoying at first because the firewall will pop up continuously asking if it should let programs connect to the internet. When the firewall pops up, google the program to see what it is before you accept it. If the first set of hits says it's a virus, it probably is. Once you know what virus you have, you can work on getting rid of it.

You will be surprised by how many programs try to connect all the time even though most of them don't need to get to the internet to run. Usually, they're just connecting to see if they should update themselves. I've been using a free version of ZoneAlarm for years and it has served me well. It never ceases to amaze me how often programs will try multiple ways of getting internet access.

Thanks for the reply.

I have Norton 360 security suit with firewall. I was asked all the time to allow to connect to outside by any program.

I tried to install MS Security Essential but it said I have it already in Win 8!

What can I do to find the virus? I have 3 computers using this email and is a business email. So can it be in anyone of them?

This problem is not confined to just this email address, the problem in the original post is from another email account. So can I assume this is from the computer, not the server?

 

[Borg]

Thanks for the reply.

I have Norton 360 security suit with firewall. I was asked all the time to allow to connect to outside by any program.

Since you used the word 'was', can I assume that the firewalls don't ask to allow programs to connect anymore? What did you do when the firewall asked to let the programs connect? Did you tell it something like "yes" and "remember my decision"?

I tried to install MS Security Essential but it said I have it already in Win 8!

You just need one virus scanner and one firewall. Installing more than one of either will cause other problems.

What can I do to find the virus? I have 3 computers using this email and is a business email. So can it be in anyone of them?

Yes.

This problem is not confined to just this email address, the problem in the original post is from another email account. So can I assume this is from the computer, not the server?

You can't assume anything. If multiple people in your contact list are getting similar spam emails that appear to be coming from you, then it is probable. But, you can't assume that it is true. Solving these things requires careful examination of your system(s).

One question that I have is how do you access your email? Do you use a program like Outlook or are you using a web-based program like Yahoo mail?

 

[yungman]

Thanks for your answer.

1) The computers still ask me whether to let the program to change anything when I install program.

2) The computers never ask whether programs can send anything out.

3) I never use Outlook. Always use Yahoo and then go to "mail" to access all my emails.

Thanks for your help.

 

[Borg]

Thanks for your answer.

1) The computers still ask me whether to let the program to change anything when I install program.

2) The computers never ask whether programs can send anything out.

3) I never use Outlook. Always use Yahoo and then go to "mail" to access all my emails.

Thanks for your help.

#1 has nothing to do with your firewall.
#2 is what a firewall will do. It doesn't sound like you have a firewall installed or it's turned off.

 

[yungman]

#1 has nothing to do with your firewall.
#2 is what a firewall will do. It doesn't sound like you have a firewall installed or it's turned off.

It said the firewall is on! I just checked. Norton always have firewall on.

 

[Borg]

It said the firewall is on! I just checked. Norton always have firewall on.

I'm not familiar with Norton's firewall so, I did a quick Google for how to configure Norton and it looks like it tries to do everything for you. I use a ZoneAlarm firewall and it doesn't assume anything. I have to tell it what to do for every program - with the option of remembering my decision. But, I like having that kind of control over my computers.

 

[AlephZero]

It said the firewall is on! I just checked. Norton always have firewall on.

... unless the virus (if you have one) turned it off, and produced a fake message when you asked Norton.

If a "successful" virus gets on to your PC somehow, it is probably going to mess with your antivirus protection software, whatever that is. That's why you usually need to boot the PC from a known virus-free disk (for example a read-only DVD) to clean it up.

 

[Chronos]

You need to isolate the source. Each computer should have a unique IP address.

 

[Routaran]

I think my computer or server is infected. I just received another email from our insurance company that we sent them a suspicious email and it's from: juangalli@fibertel.com.ar

What can I do to fix this?

Thanks

Alan

Okay, let's assume this system is infected and sending out spam. It needs cleaning.
This is how I suggest you start, we'll start doing the easy stuff first. If that doesn't work you can decide if you want to try using the more advanced tools or just wipe your system.

First, let's blow out norton from the system. It's fantastic when your system is clean but once an infection occurs, it's your worst enemy.
Norton Removal tool - http://goo.gl/uOYmWX
Make sure you have a digital copy or a disk to reinstall it, IF you want to keep using it after.

Next download the following:
Malwarebytes (Free version) - https://www.malwarebytes.org/antimalware/
Spybot Search and Destroy (Free version) - http://www.safer-networking.org/dl/

Any one of:
Avast - http://www.avast.com/en-ca/index
AVG - http://free.avg.com/ca-en/free-antivirus-download
MS Security Essentials - http://windows.microsoft.com/en-CA/windows/security-essentials-download
Those 3 antivirus programs were popular on our PF Poll
https://www.physicsforums.com/showthread.php?t=758839

Next reboot your system to safemode with networking
http://goo.gl/zXwZEE

Once in safemode
Install and update malwarebytes, then scan the system with it. Clean whatever it finds.
Repeat with Spybot Search and Destroy. Install, Update, Immunize, Clean.
Do not scan with both at the same time, use one of them, wait till you're done, then close the program before starting the next one.

After scanning once with both in safemode, reboot your computer and come back into normal mode. Do the scans again to see if the two programs see anything. If they do, clean again and reboot to normal mode again.

Then install one of the antivirus programs you selected (Avast/AVG/MSSE)
Again, update and scan. If anything comes up, clean/quarantine it.

Finally, reset your browser settings (it's like brushing your teeth every morning, just good form)
IE - http://support.microsoft.com/kb/923737
Firefox - https://support.mozilla.org/en-US/k...vcd0BQA.0&utm_referrer=https://www.google.ca/
Chrome - https://support.google.com/chrome/answer/3296214?hl=en

You can now remove all the programs we installed and go back to using Norton if you so desire. But make sure you remove the other things we installed and reboot before installing Norton.
Norton WILL go batshitcrazy on you if it thinks you cheated on it by using another antivirus program. It's a very jealous lover, so best to keep the affair with malwarebytes/spybot/avg/etc. a secret.

Now that you are done, it's time to play the waiting game. See if you get any more alerts from other ppl saying you're still spamming.

If it doesn't work, then we'll be spending more time in safemode and working with tools like
Autoruns - http://technet.microsoft.com/en-ca/sysinternals/bb963902.aspx
Hijackthis - http://sourceforge.net/projects/hjt/
Both these tools give you a detailed look at all the programs that are in your computer's startup routine. Basically, you'll need to go through the list (sometimes very large numbering hundreds of items) and figure out if there is anything malicious that is starting up when your computer runs.
Essentially, you take the filename and it's location and find out if it's legit.
This can be a very time consuming process and often, you can come across a program/dll that google doesn't tell you very much about, you may be forced to make educated guesses and if you turn off/disable the wrong entry, you can potentially kill windows.

Using those tools does require a fairly high level of familiarity with how the windows OS works and the things it does in the background, what's required, what's optional, stuff the average user never sees.
If you're not that familiar, then I very strongly suggest simply backing up important data from the system and wiping it clean. Because if something bad happens while using those tools there's a good chance you're going to be forced to wipe it anyway so save yourself the headache.