# Urgent virus problem - please help a loser

**URL:** <https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663>\
**Category:** Miscellaneous and Personal Stuff I Must Share\
**Created:** [March 9, 2008, 12:19am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663 "2008-03-09T00:19:05Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marley23](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Marley23](https://boards.straightdope.com/u/Marley23)\
**Post date:** [March 9, 2008, 12:19am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/1 "2008-03-09T00:19:05Z")

</div>

I admit it, I suck: I was trying to download an update to SpyBot last week, and somehow I downloaded a virus that seems to be sending lots of spam e-mails through my computer. I’ve downloaded a new version of Symantec, but it’s not stopping the e-mails. (Actually it’s not running at all.)

Can anybody suggest another anti-virus program I could use to stop this thing? Thanks.

---

<div class="post-metadata">

**Author:** ![Walpurgis](https://avatars.discourse-cdn.com/v4/letter/w/7ea924/32.png) [@Walpurgis](https://boards.straightdope.com/u/Walpurgis)\
**Post date:** [March 9, 2008, 12:23am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/2 "2008-03-09T00:23:09Z")

</div>

If you look in the GQ forum, there’s a sticky at the top about computer questions. The first posts are very good how-to manuals for emergencies such as yours. Links for various anti-virus programs and descriptions for how to use them. Start there and good luck. 🙂

---

<div class="post-metadata">

**Author:** ![AuntiePam](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@AuntiePam](https://boards.straightdope.com/u/AuntiePam)\
**Post date:** [March 9, 2008, 12:24am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/3 "2008-03-09T00:24:04Z")

</div>

I don’t know how it works with an already-infected machine, but I’ve been happy with the AVG program for more than two years. [Link to the free edition](http://free.grisoft.com/).

Good luck!

---

<div class="post-metadata">

**Author:** ![Marley23](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Marley23](https://boards.straightdope.com/u/Marley23)\
**Post date:** [March 9, 2008, 12:30am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/4 "2008-03-09T00:30:18Z")

</div>

Thanks guys, I’ll start there when I get home. I figured there was an easy answer posted someplace…

---

<div class="post-metadata">

**Author:** ![Marley23](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Marley23](https://boards.straightdope.com/u/Marley23)\
**Post date:** [March 9, 2008, 2:51am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/5 "2008-03-09T02:51:22Z")

</div>

Ok, I’m working on this now… I downloaded the AVG program and it’s been scanning for 45 minutes, but so far it hasn’t caught anything and some of the e-mails are still being sent. I also downloaded ewido, but haven’t run it yet.

If it helps, the messages I get look like this:

> [@Symantec Email Proxy](#):
>
> Your email message was unable to be sent because your mail server rejected the message;  
> 554 delivery error: dd --Boiler plate here about how the email was rejected as spam or the address is invalid–

---

<div class="post-metadata">

**Author:** ![astro](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@astro](https://boards.straightdope.com/u/astro)\
**Post date:** [March 9, 2008, 3:45am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/6 "2008-03-09T03:45:56Z")

</div>

[QUOTE=Marley23]  
Ok, I’m working on this now… I downloaded the AVG program and it’s been scanning for 45 minutes, but so far it hasn’t caught anything and some of the e-mails are still being sent. I also downloaded ewido, but haven’t run it yet.

If it helps, the messages I get look like this:  
[/QUOTE]

I used AVG because it was free, but it’s definitely a second string anti virus program and the worm I had utterly baffled it because it was hiding in dll files and constantly re-initialized itself. When I got infected a year or so ago I had to use Kaspersky trial version to properly identify it, and then a stand alone module crafted specifically for the worm to get rid of it. Don’t count on AVG to detect or fix the more virulent viruses.

---

<div class="post-metadata">

**Author:** ![astro](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@astro](https://boards.straightdope.com/u/astro)\
**Post date:** [March 9, 2008, 3:47am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/7 "2008-03-09T03:47:39Z")

</div>

duplicate post - ignore

---

<div class="post-metadata">

**Author:** ![Marley23](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Marley23](https://boards.straightdope.com/u/Marley23)\
**Post date:** [March 9, 2008, 4:00am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/8 "2008-03-09T04:00:05Z")

</div>

I’ll definitely try something else if this doesn’t get the job done, then - it’s been two hours and nothing has been solved so far. I don’t understand why AdAware hasn’t spotted this. I tried SpyBot again, too, against my better judgment, and it hasn’t detected this thing either.

---

<div class="post-metadata">

**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\
**Post date:** [March 9, 2008, 4:06am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/9 "2008-03-09T04:06:31Z")

</div>

Are you sure your computer is actually sending emails? Would you be able to shut down Outlook for a day (use webmail instead, if available) and see if it still happens?

Do you see any indication in Task Manager as to something actually running that you don’t know what it is? Right-click on your clock and choose “Task Manager” and click the “Processes” tab. Check the “Show Processes from all users” box. Click the “CPU” and “Mem Usage” column headers to sort by CPU usage and Memory Usage and see what’s actively “running” and looks like it might be sending out email.

I’m kind of dubious about modern email programs sending emails out without alert anymore. I could be very wrong, though. But there’s a good chance that someone just spoofed your address and sent a whole bunch of spam emails with your address, and now you’re getting the undeliverable messages. In that instance, you don’t have a virus and there’s nothing you can really do about it other than contact your email service provider and let them know you think that’s what happened.

---

<div class="post-metadata">

**Author:** ![Marley23](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Marley23](https://boards.straightdope.com/u/Marley23)\
**Post date:** [March 9, 2008, 4:16am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/10 "2008-03-09T04:16:36Z")

</div>

You know, you may be onto something- I never use Outlook. There are a lot of programs in the task manger that I can’t identify - mostly small ones. I couldn’t say what they do, although at the very least I guess they are slowing down my computer. Is there something in particular I should look for?

They’re all small .exe files and things. There’s dozens of them, it looks like. How can I tell if they are sending e-mails or doing other stuff?

---

<div class="post-metadata">

**Author:** ![astro](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@astro](https://boards.straightdope.com/u/astro)\
**Post date:** [March 9, 2008, 4:17am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/11 "2008-03-09T04:17:06Z")

</div>

[QUOTE=ZipperJJ]  
Are you sure your computer is actually sending emails? Would you be able to shut down Outlook for a day (use webmail instead, if available) and see if it still happens?

Do you see any indication in Task Manager as to something actually running that you don’t know what it is? Right-click on your clock and choose “Task Manager” and click the “Processes” tab. Check the “Show Processes from all users” box. Click the “CPU” and “Mem Usage” column headers to sort by CPU usage and Memory Usage and see what’s actively “running” and looks like it might be sending out email.

I’m kind of dubious about modern email programs sending emails out without alert anymore. I could be very wrong, though. But there’s a good chance that someone just spoofed your address and sent a whole bunch of spam emails with your address, and now you’re getting the undeliverable messages. In that instance, you don’t have a virus and there’s nothing you can really do about it other than contact your email service provider and let them know you think that’s what happened.  
[/QUOTE]

Is this spamming has happened you can also sometimes go into the webmail version of your ISP’s email client and delete the messages en mass there before they ever get to your PCs email program. It’s easer to do it this way beacause the incoming messages can overwhelm you PC clients ability to function.

---

<div class="post-metadata">

**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\
**Post date:** [March 9, 2008, 4:29am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/12 "2008-03-09T04:29:37Z")

</div>

[QUOTE=Marley23]  
You know, you may be onto something- I never use Outlook. There are a lot of programs in the task manger that I can’t identify - mostly small ones. I couldn’t say what they do, although at the very least I guess they are slowing down my computer. Is there something in particular I should look for?

They’re all small .exe files and things. There’s dozens of them, it looks like. How can I tell if they are sending e-mails or doing other stuff?  
[/QUOTE]

What do you use instead of Outlook? Do you have Outlook or Outlook Express installed? Outlook is “OUTLOOK.EXE” and Outlook Express is “msimn.exe”

In order for any email program to send mail from your computer without your knowledge, you at least need to have your email account programmed into an email client (email client = Outlook, Outlook Express, Eudora, Thunderbird, etc). Have you ever set up any of those or do you just use web-based email?

---

<div class="post-metadata">

**Author:** ![Marley23](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Marley23](https://boards.straightdope.com/u/Marley23)\
**Post date:** [March 9, 2008, 4:36am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/13 "2008-03-09T04:36:46Z")

</div>

No, I just use Gmail and (cringe of embarrassment) AOL. Outlook is probably installed but the task manager says it isn’t running.

---

<div class="post-metadata">

**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\
**Post date:** [March 9, 2008, 4:45am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/14 "2008-03-09T04:45:30Z")

</div>

[QUOTE=Marley23]  
No, I just use Gmail and (cringe of embarrassment) AOL. Outlook is probably installed but the task manager says it isn’t running.  
[/QUOTE]

So are you saying that you suspect that someone is sending gmail emails from your computer, or AOL emails?

There’s no way someone can send gmail emails from your computer unless you have it hooked into an email client on your computer. If your issue is gmail, it’s definitely spoofing.

If it’s AOL, then check your task manager to see what AOL is doing.

---

<div class="post-metadata">

**Author:** ![Marley23](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Marley23](https://boards.straightdope.com/u/Marley23)\
**Post date:** [March 9, 2008, 4:55am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/15 "2008-03-09T04:55:08Z")

</div>

No, at this point I think you’re correct about the spoofing thing.  
I’ve gotten a few pieces of Gmail spam in recent days from an address similar to mine and I guess this is related to that. Is there anything I can do?

---

<div class="post-metadata">

**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\
**Post date:** [March 9, 2008, 5:06am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/16 "2008-03-09T05:06:15Z")

</div>

[QUOTE=Marley23]  
No, at this point I think you’re correct about the spoofing thing.  
I’ve gotten a few pieces of Gmail spam in recent days from an address similar to mine and I guess this is related to that. Is there anything I can do?  
[/QUOTE]

Yeah someone is doing a dictionary attack of sorts, then. Sending spam from [marley@gmail.com](mailto:marley@gmail.com), marley1, marley2, marley3, etc (or whatever your username is).

You could try to report it to Google but I don’t even know if there’s anything they can do. Not sure what they can do to keep people from typing any email address into a return path or a from header in their spam emails.

---

<div class="post-metadata">

**Author:** ![Marley23](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Marley23](https://boards.straightdope.com/u/Marley23)\
**Post date:** [March 9, 2008, 5:12am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/17 "2008-03-09T05:12:18Z")

</div>

Yeah, that’s depressingly logical. So there’s no way to get these alerts to go away? They’re very annoying.

---

<div class="post-metadata">

**Author:** ![astro](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@astro](https://boards.straightdope.com/u/astro)\
**Post date:** [March 9, 2008, 5:17am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/18 "2008-03-09T05:17:36Z")

</div>

[QUOTE=Marley23]  
Yeah, that’s depressingly logical. So there’s no way to get these alerts to go away? They’re very annoying.  
[/QUOTE]

I don’t get it. My gmail webmail never sends “alerts”. How is your gmail generating these “alerts” that page your PC in some manner.

---

<div class="post-metadata">

**Author:** ![Marley23](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Marley23](https://boards.straightdope.com/u/Marley23)\
**Post date:** [March 9, 2008, 5:22am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/19 "2008-03-09T05:22:26Z")

</div>

[QUOTE=astro]  
I don’t get it. My gmail webmail never sends “alerts”. How is your gmail generating these “alerts” that page your PC in some manner.  
[/QUOTE]

Well, they’re from Symanted, not Gmail. But I don’t know how that’s working either.

---

<div class="post-metadata">

**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\
**Post date:** [March 9, 2008, 5:27am UTC](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663/20 "2008-03-09T05:27:41Z")

</div>

They’re undeliverable messages from an email server that is protected by “Symantec Email Proxy” that is getting “his” spams at an address on their server. They’re not coming on to his PC, **astro**.

**Marley** , block email with “Symantec Email Proxy” in the body.

[Next page](https://boards.straightdope.com/t/urgent-virus-problem-please-help-a-loser/440663.md?page=2)
