More info would be useful, like: are you using Hotmail as “web mail” (i.e., by logging in trough their web page) or via Outlook?
Anyway, besides being infected the possibilities are the following:
A: some wicked person had nothing better to do than to send viruses to people using your e-mail address as the return path OR
B: A friend of yours who had your address on his computer got infected. (this is, I believe, the most likely case) The virus tries to propagate by sending itself to the entire “contacts” list on the infected computer, but also makes the e-mail to look like they come from one of those contacts.
To find out the real origin of the offending e-mails you can do the following:
Go to the Hotmail webmail account. Click on the “Options” tab and on the right side column, under “additional options” click on “mail display settings”
Check “advanced” for “message headers”. Click OK at the bottom of the page.
Go back and click on the offending message. Before the actual message, you should see a “header” in blue with all sorts of information and a link to “view e-mail message source”. Click on it. A new window will open and you will see someting like this: (taken from an actual spam message) ---------------------------------------------------
X-Message-Info: JGTYoYF78jEHjJx36Oi8+Q1OJDRSDidP
Received: from **64.222.177.209 **([64.222.177.209]) by mc9-f17.bay6.hotmail.com with Microsoft SMTPSVC(5.0.2195.5600);
Fri, 25 Jul 2003 17:35:17 -0700
From: “smabqkmrki” <smabqkmrki@yahoo.com>
To: <oblivious_victim@hotmail.com>
Date: Thu, 24 Jul 2003 19:36:09 -0600
Subject: unbelivable secret important important must see great secret birhepeh
Message-ID: <169239722178$24251758$17851264@VGMEUY>
MIME-version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_DA3BCFA3.AAAC1D31"
X-Priority: 3
X-MSMail-priority: Normal
X-Mailer: QUALCOMM Windows Eudora Version 5.1
Content-Transfer-Encoding: 7bit
Return-Path: smabqkmrki@yahoo.com
X-OriginalArrivalTime: 26 Jul 2003 00:35:17.0685 (UTC) FILETIME=[C980D650:01C3530D]
(there’s a lot more after that, but it doesn’t matter; What we want to find is in the second line; again, this is how the line sould look:
Received: from **64.222.177.209 **([64.222.177.209]) by mc9-f17.bay6.hotmail.com with Microsoft SMTPSVC(5.0.2195.5600);
Fri, 25 Jul 2003 17:35:17 -0700
And there we have it: the REAL (Internet) address from which the annoying e-mails originate: 64.222.177.209.
But we’re not done yet… Copy the address on your clipboard It’s important to be exact here. Go to: http://ww1.arin.net/whois/ and paste the address in the form on the page, then click on “submit query”
You should get something like this: (again, actual example for the spam above):
Search results for: **64.222.177.209 **
OrgName: Verizon Global Networks, Inc.
OrgID: VGBN
Address: 1880 Campus Commons Drive
City: Reston
StateProv: VA
PostalCode: 20191
Country: US
NetRange: 64.222.0.0 - 64.223.255.255
CIDR: 64.222.0.0/15
NetName: VZGNI-PUB-5
NetHandle: NET-64-222-0-0-1
Parent: NET-64-0-0-0-0
NetType: Direct Allocation
NameServer: NSDC.BA-DSG.NET
NameServer: GTEPH.BA-DSG.NET
Comment:
RegDate:
Updated: 2001-05-31
TechHandle: BN-ORG-ARIN
TechName: Verizon Global Networks Inc.
TechPhone: +1-703-295-4583
TechEmail: noc@gnilink.net
There… now you can… start from here: try to figure out who a) Has your e-mail address and b) is using the ISP (Internet Service Provider) that you will find (note that the ISP may be anyone: AOL, Earthling, Cox, Roadrunner, etc.) If you can limit the “suspects” to a few, contact them and tell them they may be infected.
Another option is to call the number provided for that particular ISP and explain your problem to their tech support. Most likely they can find the physical location of the offending computer. (they will not disclose it to you, but they may contact the person found at that address)
If you can’t open the message addressed to you, try to open one of the “replies” from ISP’s refusing to forward your e-mail because of the virus. After some message from that ISP the e-mail should have a part saying: “Original message:” and in it the same lines as in the example above (Received from, return path, etc.) find the line with "received from ([xxxx.xxxx.xxxx.xxxx]). Copy the number between ([ and ]). Repeat the rest of the steps.
I hope this helps.
