# Does this indicate an email virus? **URL:** \ **Category:** Factual Questions\ **Created:** [November 18, 2005, 7:39am UTC](https://boards.straightdope.com/t/does-this-indicate-an-email-virus/331621 "2005-11-18T07:39:21Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![roger\_thornhill](https://avatars.discourse-cdn.com/v4/letter/r/d9b06d/32.png) [@roger\_thornhill](https://boards.straightdope.com/u/roger_thornhill)\ **Post date:** [November 18, 2005, 7:39am UTC](https://boards.straightdope.com/t/does-this-indicate-an-email-virus/331621/1 "2005-11-18T07:39:21Z")
Twice in the last week or so, I’ve received a message entitled “Returned mail: Over quota” from “Mail Delivery Subsystem \<[MAILER-DAEMON@imap02.bwc.ap.blackberry.net](mailto:MAILER-DAEMON@imap02.bwc.ap.blackberry.net)\>” in response to a email I sent; in the second case to just a single addressee (not of course [MAILER-DAEMON@imap02.bwc.ap.blackberry.net](mailto:MAILER-DAEMON@imap02.bwc.ap.blackberry.net)). I believe the emails went through normally to the addressees in each case. The text of the message I received today read: "The original message was received at Fri, 18 Nov 2005 07:30:22 GMT from mx01.bwc.prodap.on.blackberry [172.16.179.184] ----- The following addresses had permanent delivery errors ----- \<[threehk-menzies1@imap02.bwc.ap.blackberry.net](mailto:threehk-menzies1@imap02.bwc.ap.blackberry.net)\>" Ought I to get my computer checked for viruses? ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [November 18, 2005, 1:24pm UTC](https://boards.straightdope.com/t/does-this-indicate-an-email-virus/331621/2 "2005-11-18T13:24:08Z")
Probably not (though it would hurt to go to [http://housecall.trendmicro.com](http://housecall.trendmicro.com) and do a scan). Bounce messages, if it’s not from somone you’ve sent an e-mail, usually mean that a virus spoofed your e-mail address. That only means that someone with the virus has your e-mail address somewhere on their computer (including on any websites they visited). The virus e-mails are sent with a faked – thought legitimate – address, so any bounce messages go to that address. It’s possible that the message contained a virus – some use that format to fool the user, but as long as you didn’t click on any attachment with it, you’re OK. ---
**Author:** ![gotpasswords](https://avatars.discourse-cdn.com/v4/letter/g/c57346/32.png) [@gotpasswords](https://boards.straightdope.com/u/gotpasswords)\ **Post date:** [November 18, 2005, 4:28pm UTC](https://boards.straightdope.com/t/does-this-indicate-an-email-virus/331621/3 "2005-11-18T16:28:25Z")
A newish wrinkle is spoofed or faked “bounce” notices. The virus-mongers send out emails that look like returned-mail notices, but nestled within the message are “one-pixel” blank images that trigger downloads if you happen to click on what looks like blank white space in the message. Or even worse, with the use of Java, trigger downloads if you merely move the mouse over the hidden spots. ---
**Author:** ![roger\_thornhill](https://avatars.discourse-cdn.com/v4/letter/r/d9b06d/32.png) [@roger\_thornhill](https://boards.straightdope.com/u/roger_thornhill)\ **Post date:** [November 19, 2005, 2:31am UTC](https://boards.straightdope.com/t/does-this-indicate-an-email-virus/331621/4 "2005-11-19T02:31:18Z")
Thanks, guys. I’ll be very careful. ---
**Author:** ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)\ **Post date:** [November 19, 2005, 9:48am UTC](https://boards.straightdope.com/t/does-this-indicate-an-email-virus/331621/5 "2005-11-19T09:48:29Z")
> [@gotpasswords](#): > > A newish wrinkle is spoofed or faked “bounce” notices. The virus-mongers send out emails that look like returned-mail notices, but nestled within the message are “one-pixel” blank images that trigger downloads if you happen to click on what looks like blank white space in the message. Or even worse, with the use of Java, trigger downloads if you merely move the mouse over the hidden spots. Thanks I’ll pay attention too because I got recently a number of such “bounced” notices, with an attached message in a foreign language I can’t identify, and sender/recipient fields mentionning e-mail adresses completely unknown to me. I had assumed that my e-mail adress could have been used to send spam or somesuch… ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [November 19, 2005, 4:09pm UTC](https://boards.straightdope.com/t/does-this-indicate-an-email-virus/331621/6 "2005-11-19T16:09:03Z")
> [@clairobscur](#): > > I had assumed that my e-mail adress could have been used to send spam or somesuch… Just remember that the FROM address on an email does not tell where it is FROM, just where the sender wants you to think it is from. ---
**Author:** ![Bookkeeper](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bookkeeper/32/281_2.png) [@Bookkeeper](https://boards.straightdope.com/u/Bookkeeper)\ **Post date:** [November 20, 2005, 4:36am UTC](https://boards.straightdope.com/t/does-this-indicate-an-email-virus/331621/7 "2005-11-20T04:36:28Z")
If you, like a lot of people, are using Outlook Express, you can check a message without opening it (you do have “Show preview pane” turned OFF in _View|Layout_, I trust), by right-clicking on the e-mail, selecting _Properties_ from the menu, then clicking on the _Details_ tab. This will show you a lot of info about the message, including who it is really from (check the _Return Path_ and the **complete** _From_ address). Click on the _View Source_ button to see the actual message text, including all the bits not normally displayed when you open it in your message window. Note that an HTML format message will include large amounts of HTML code from which you will need to pick out the relevent message text, but this allows you to also see the hidden Java codes that will trigger malware activity, the **real** URL for the link you are supposed to click, etc. Very handy for checking out suspicious e-mails. I assume that other e-mail programs have similar message inspection functions (although the Office XP verion of Outlook we have at the office doesn’t seem to have the View Source button). Here is an example of the info displayed in the View Source window: > [@](#): > > Return-Path: \<[mktg@registerzdi-marketing.com](mailto:mktg@registerzdi-marketing.com)\> > Received: from [3.76.omessage.com](http://3.76.omessage.com) ([43.76.omessage.com](http://43.76.omessage.com) [205.162.43.76]) > by [in1.isp.com](http://in1.isp.com) (ISP’s Mail Server) with SMTP id jAIFwlSF019240 > for \<[myemail@isp.com](mailto:myemail@isp.com)\>; Fri, 18 Nov 2005 10:58:48 -0500 > Message-Id: \<[200511181558.jAIFwlSF019240@in1.isp.com](mailto:200511181558.jAIFwlSF019240@in1.isp.com)\> > From: “Ziff Davis TiPS-IT” \<[mktg@registerzdi-marketing.com](mailto:mktg@registerzdi-marketing.com)\> > To: [myemail@isp.com](mailto:myemail@isp.com) > Subject: Latest report on Anti-Spam Solutions > Date: Fri, 18 Nov 2005 04:00:00 -0600 > Content-Type: multipart/mixed; boundary="----\_NextPart\_9OhIdsY3kdYZ4cR1iF96uTD6l.UAA0s5AAeKQgE=" > MIME-Version: 1.0 > X-MailSessionID: 9OhIdsY3kdYZ4cR1iF96uTD6l.UAA0s5AAeKQgE= > X-Spam-Status: X-Spam-Status: hits=4.7 > ------\_NextPart\_9OhIdsY3kdYZ4cR1iF96uTD6l.UAA0s5AAeKQgE= > Content-Type: text/html > Content-Transfer-Encoding: quoted-printable > > \ > \ > \ Ziff Davis TiPS-IT Enterprise Anti-Spam Product Comparison Guide\ itle\> > \ > > … I have replaced my own e-mail address and removed all but the beginning of the HTML coding, but you can see that the _From:_ address that is visible to you in the message window is not the real source of the message. Fake From: addresses are often just a case of an e-mail program configured to display “John Doe” in place of the less recognizable “jdoe5678@mega\_isp.com”, but it can also indicate that someone is trying to hide the source of a message of evil intent. If the message claims to be from your bank in Omaha, but the Return Path or From info shows it to be from an unfamiliar address in Russia, it’s a fake. (Actually, if it claims to be from your bank, it’s almost certainly a fake anyway. 😃 )