Hehe got about 800 mails today, hurray for people still using outlook or whatever other crappy mail client.

Qbix wrote:

Today alone I got 50 delivery failure mesages. So go thinking how many the virus send.

Anybody got an idea how to find the infected pc who is creating the message s ?

Depending on how the destination servers handled the delivery failure messages, they may contain all the original headers with clues leading to the original sender. Do you want some help taking a look at them?

Regards,

They don't. The virus, SoBigg.F@mm, does a nice job of masking the true sender. Good thing it dies September 10.

Snover wrote:

They don't. The virus, SoBigg.F@mm, does a nice job of masking the true sender.

Any virus/worm can try to mask the e-mail address of the sender, but as soon as it sends a message the SMTP server that receives it will certainly log the IP address that originated the message and a timestamp. This should be true for all servers that are involved in handling the message, starting with the relay server at the sender's ISP. Take a look at the full header of a message and look for lines starting with "Received by:".

Regards,

I actually checked quite some headers myself.

No good use for them (quite some originate from 127.0.0.1)

I would glad if the virus died. I still get +100 each day which is 10 mb for my mailbox.

Qbix wrote:

I actually checked quite some headers myself.

No good use for them (quite some originate from 127.0.0.1)

That's strange. Even if someone uses his own PC as an SMTP server, the next server (problably at your ISP) would add a header identifying the public IP address for the sender. There's no way to masquerade this, since the SMTP server will log the IP address from the other server talking to it as informed by the TCP/IP stack. In other words, some traces must remain.

BTW, are you sure that your Linux box is not receiving malformed mails and/or non-delivery reports that end up "bouncing" inside your own machine?

Regards,

Nope the mail is on an imap server (which isn't my linux box)

I'm gratefull for that as else i would have to download all that shit as well. Now I only have to delete it on the server !;)