Sobig aftereffects: email piling up?

Nearly a week ago, I noticed the volume of my non-virus email, spams included, had dropped off from the typical 60 messages a day to about 3.

I have no spam filter activated (I do have a virus filter in place, and it reported a drastic dropoff in Sobigs & Blasters, but that might be because the worldwide infection is running its course).

Tests of messages sent from me to me, even from a hotmail addr to my non-hotmail addr (and vice-versa) were delivered within minutes to hours, but a test sent from a friend’s mailbox showed only 1/2 of the mail is being delivered within 24 hours. The rest has not yet arrived.

Mail sent to one domain seems to get to me, but another domain that forwards mail to me does not. The Registrar of the latter domain says nothing is wrong on their end, and the account is paid up for several years.

My ISP claims their email servers, due to the Sobig/Blaster epidemic, have been spooling all messages, doing load balancing, etc., and I will eventually get everything that is being stored. But they cannot say if that will be hours, days, or weeks. Meanwhile, I am in limbo, and don’t know if people can communicate with me or not. Outgoing mail seems to work, but I can’t be sure about that, either.

Anyone else experiencing this kind of email bottleneck or delays? Or is the ISP just stringing me along with an excuse for a failure on their part?

Some ISP’s are better than others about keeping the after effects of all of that stuff out. I think AOL does a pretty good job here. Mine isn’t so good. I’m getting about 3-10 e-mails a day too, which mostly seem to be the after effects of this particular virus. I talked to my computer guru about this a week earlier, and he said as long as I’m not opening the attachments, and not clicking on to other stuff, I probably won’t get infected. So even if you’re getting messages claiming to have been sent to you, or claiming your computer is infected, it’s a good chance it’s not. I’ve done the virus scans and mine continue to check out okay. There is one virus among a few others along the lines of KLEZ that will automatically infect your computer, simply by just getting into your mail once you’ve only highlighted it in blue once. I had one of those before I got Norton anti-virus. These are mostly variations of the older KLEZ, and any good virus protection program should automatically be taking care of these for you.

JZ

John Zahn, I don’t have a virus. This is not about an infection in my computer(s), and I am well aware of the characteristics of the common strains like Klez, Sobig, Badtrans, etc. (until the number of worms reached 50 per hour recently, I enjoyed sorting them out manually and didn’t use an automatic filter).

I am talking about receiving email and a possible backlog of messages, legitimate & otherwise, that may be waiting in a queue somewhere to be spewed out to my mailbox eventually. Any involvement with a virus may be only the extreme traffic that the Sobig & Blaster generated a few weeks ago, clogging the Internet pipeline.

I have noticed a very sharp drop in spam at hotmail but have received my emails pretty normally. I believe they are just getting more effective at blocking spam, not that everything is being delayed.

But I have no spam blocker active at my computer or at my ISP. My ISP offers Postini, but the spam function is turned off.

I haven’t gotten any e-mail since Aug. 28th. My ISP, insight, is blaming it on my McAfee SpamKiller. I’ve been trying to tweak past it without paying a passel of tech-support charges, without success so far. I’ve been getting angry over it, and I don’t like getting angry.

My mail is definitely not getting thru – I’d say 85% is getting returned, blocked or delayed for days. Here is part of the error message received by a friend who tried to send me something:


----- Original Message -----
From: <MAILER-DAEMON@remt21.cluster1.charter.net>
To: <mzpat@charter.net>
Sent: Tuesday, September 02, 2003 7:00 PM
Subject: Undeliverable mail: none

Failed to deliver to ‘musicat@doorbell.net’
SMTP module(domain doorbell.net) reports:
eforward1.enom.com: connection refused

mzpat@charter.net” is the person trying to send to me; “musicat@doorbell.net” is the intended recipient, my domain hosted on a local ISP’s server. “enom.com” is the domain name registrar. All mail coming to @doorbell.net is supposed to be funnelled to musicat@doorpi.net. “doorpi.net” is the ISP.

What’s going on here? Is the registrar at fault, the ISP or something else? They all say things are working perfectly, but obviously they aren’t.

AskNott, does your ISP let you control the settings on the spam filter, or are you at their mercy? The postini filter on mine can be tweaked by the end-user or disabled. Did you try going to your ISP’s home page?

Well, email servers are overloaded because of Sobig.F, that’s for sure. Probably the main cause.

Anyway, there was an article on Slashdot about shutdown of a major spammer last week. Maybe this has also had certain effect?

I’ve been getting emails in my inbox that say “undeliverable” (as if I sent them and they bounced back) and they indicate I’ve got this virus. However, I have run updated Norton Antivirus, the Symantec sobic tool, and Spybot. They all say I have no virus.

Are the bounceback emails really coming from my system or from somewhere else? I think I’ll unplug my modem for a while and see if I still get these “bouncebacks”. I don’t get it.

Oh, and I have also tried the manual removal instructions, but I didn’t have the particular problems in regedit that this virus purportedly creates.

[Simplifying for clarity…] This just means that somebody who has your email address in his address book has gotten the virus. So, the virus infects your friend’s machine. It picks up email addresses from his address book, and uses them as the “from” field on the spam it sends out. A lot of the messages are undeliverable, and they get bounced back. But since YOUR address now appears as the sender, they come back to you. Nothing you can do about, but wait for the storm to subside.

Thanks!

Bearflag70, to complicate the issue, there are some viruses that create a message saying “undeliverable” even though they are generated by the virus.

My ISP did some stuff to my account, and new emails seem to be flowing in now at a near-normal rate. But that leaves an estimated 350 messages that haven’t reached me yet or have been routed into a black hole.

What I hate about this is the uncertainty. My ISP can’t or won’t tell me if I have data waiting or not, and how long it will take before I get it and how much there is. They just say, “Let’s sit back and see what happens for a few weeks.” What a way to run a business!

As of yesterday, I was still getting 300+ per day.

Same here. I hate autoresponders with a passion now.

I may not be the only one experiencing this kind of action:

From http://www.techtv.com/news/shownotes/story/0,24195,3510307,00.html
or
http://www.news.com.au/common/story_page/0,4057,7173304%5E15306,00.html
or
http://silicon.com/news/500019-500001/1/5885.html

But this seems to be from an upgrade that went awry, not an excess of email traffic due to viruses.

Well, last night when I went to bed at about 10 pm, I unplugged my modem. I plugged it back in at about noon today.

I received a series of these “bounceback emails” that apparently indicate the time the offending emails were sent as well as the time the emails bounced back to me. These bouncebacks indicate that my system sent out virus-laden emails and these emails bounced back to me during the period my modem was unplugged. There is nothing in my Outbox indicating that I sent anything.

This is consistent with the idea that someone else has the virus, the emails are being sent in my name from some other computer, and, as a result, they are bouncing back to me instead of bouncing back to the infected system.

I thought I would post this to help others with similar problems.

I am considering sending out a broadcast email to EVERYONE in my address book asking them to clean their systems.

Another indicator that the offending emails are not originating from my system is that the emails are bouncing back from people who are not in my address book.

Have not noticed any traffic jam. I get email from thousands of miles away, across continents, and they are recent.