Hotmail Virus

[wowser]

I recieved this email with the following message body:

A virus was found in a message sent by this
account.

--- Scan information follows ---

Result: Virus Detected
Virus Name: W32.Netsky.P@mm
File Attachment: document43.zip
Attachment Status: infected

Result: Virus Detected
Virus Name: W32.Netsky.P@mm
File Attachment: document43.zip/document.txt*****************************************************************
.exe
Attachment Status: infected

--- Original message information follows ---

From: [my email address]@hotmail.com
To: info@lwe.liebherr.com
Date: Sun, 2 May 2004 11:21:50 -0700
Subject: Re: Its me

Is this a virus in my Hotmail account; a hoax or something else? Surely not a virus on my Mac?

Thanks
Ed

[Mav451]

I don't think so. I get these kind of emails all the time in Thunderbird (no way I touch Outlook anytime soon).

I have NEVER sent an email with an attachment, so it goes without saying its probably just some virus running amok on the Hotmail/local server. I know @ UMD, too many students don't watch what attachments they get and click them (thus spreading the virus).

Even if it says you sent it, its B.S.

[rainman::|:|]

a virus can't actually *do* things in your hotmail account... it could only sit dormant, waiting for you to download to your computer. And if that's an OS X computer, nothing would happen. BUT in this case, you don't even have a virus, someone loosely connected to you does, the virus found your email address on their computer and sent out copies of itself with your name as the return address. so, they bounce back to you.

There are dozens of similar threads already. Search for "virus".

paul

[Benjamin]

well.. first hotmail is a virus itself.. and what you have is just a propagation of some virus that resends itselft, which needs windows or hotmail to run. fake headers etc.

[wowser]

phew! Thatnks guys - sounds like my Mac is safe :)

[Duff-Man]

Duff-Man says....go over to Symantec or McAfee and read up on the netsky virus and you'll see exactly what has just happened....oh yeah!

[virividox]

although macs arent affected we should still try to delete emails with viruses because if they are accidentaly forwarded we could infect people using windoze

[mkrishnan]

phew! Thatnks guys - sounds like my Mac is safe :)

Most likely a computer *at Hotmail* was infected, i.e. a mail server, and it was sending out virii under people's names in the server's mail directory. This happened to me at work too -- I got mails like this when I don't send infected attachments and to people who aren't even in my address book. I think this particular virus infects the mail server, grabs random names out of the incoming and outgoing mail, and random names from the directory of users of that server and sends out the virii itself under their names.

[Benjamin]

although macs arent affected we should still try to delete emails with viruses because if they are accidentaly forwarded we could infect people using windoze

and this is a bad thing?

[IrishGold]

and this is a bad thing?

Yes:

More infected windows machines = more sent out emails which then = more problems with networks, spam, ect.

[Benjamin]

Yes:

More infected windows machines = more sent out emails which then = more problems with networks, spam, ect.

wow way to stat the obvious, oh well. poor attempt on my part to use humor.

[IrishGold]

wow way to stat the obvious, oh well. poor attempt on my part to use humor.


Yes, poor attempt. Add a smilie or something next time.

[wowser]

wow - that's quite shoddy if Hotmail servers have a virus. i deleted the email, and the info supplied at Symantic suggested that it was a virus that affected smtp servers.

[MisterMe]

Most likely a computer *at Hotmail* was infected, i.e. a mail server, and it was sending out virii under people's names in the server's mail directory. This happened to me at work too -- I got mails like this when I don't send infected attachments and to people who aren't even in my address book. I think this particular virus infects the mail server, grabs random names out of the incoming and outgoing mail, and random names from the directory of users of that server and sends out the virii itself under their names.Hotmail's servers run FreeBSD. After buying Hotmail, Microsoft spent years trying to convert the service from FreeBSD to Microsoft-based servers. IIRC, it gave up in frustration. These viruses don't work by infecting mail servers, but they may spoof them.

[mkrishnan]

Hotmail's servers run FreeBSD. After buying Hotmail, Microsoft spent years trying to convert the service from FreeBSD to Microsoft-based servers. IIRC, it gave up in frustration. These viruses don't work by infecting mail servers, but they may spoof them.

Oh, yeah, I do remember reading the conspiracies about MS using open source software a couple of months ago. Sorry! :(

[MisterMe]

Oh, yeah, I do remember reading the conspiracies about MS using open source software a couple of months ago. Sorry! :(These are not rumors. Nor are they conspiracies. Hotmail existed long before M$ bought it. Hotmail was built on FreeBSD.

[mkrishnan]

These are not rumors. Nor are they conspiracies. Hotmail existed long before M$ bought it. Hotmail was built on FreeBSD.

No, no, sorry again (and then I'll stop apologizing). The conspiracies were not *that* MS was using FreeBSD but all kinds of things surrounding how MS was trying to hide that it ran better than their own servers, etc. The explanation (that they use it b/c they acquired a working system from Hotmail) is much less conspiratorial. :)

[MisterMe]

No, no, sorry again (and then I'll stop apologizing). The conspiracies were not *that* MS was using FreeBSD but all kinds of things surrounding how MS was trying to hide that it ran better than their own servers, etc. The explanation (that they use it b/c they acquired a working system from Hotmail) is much less conspiratorial. :)It is not just open source. Microsoft only forces its customers to use its products. Internally, it uses the best products available, which may be Macintoshes or any variety of UNIXen. One of the more humorous instances happened a few years ago when it was revealed that an erroneous URL such as http://www.microsoft.com/huh? would result in a generic Apache error message.
Netcraft (http://uptime.netcraft.com/up/graph?site=www.microsoft.com) queries revealed a collection of UNIX servers from DEC and other vendors. Within a week, the error messages changed and the UNIX servers no longer showed up in Netcraft. Clearly, it cannot port a web presence as large as Microsoft's from UNIX to Windows in a week. Afterall, it could not port Hotmail to Windows after years. I suspect that there remains a lot of UNIX behind that curtain.