Sober virus

William9 · 15 Dec 2005, 09:41 AM

I've had a lot of emails with the sober virus removed by FastMail. At least that's the message on some of my emails.
I would like to know more about back scatter. I've received many emails from an email server saying that the message I sent couldn't be delivered because it contained the sober virus. The address to me is my domain, but not my username. Is this back scatter? I doubt that I sent the virus because a use a Macintosh for sending messages. Can anyone describe what back scatter is and why I'm receiving messages from another server addressed to "postmaster" or something similar in my domain accusing me of sending a virus laden email?

n5bb · 15 Dec 2005, 11:36 AM

This is most probably caused by a spammer spoofing your email address as their return address. Unfortunately, this has become very common.

Here are some threads with related comments and ways to filter these messages:
spammer with (apparently) fastmail.fm address
How to filter out "mail delivery failure" spam?
Spam: "Returned" E-Mails

hadaso · 16 Dec 2005, 09:02 AM

What you are getting is most probably email delivery failure messages for email sent by a Sober virus with email addresses in your domain as "From". I get tons of these, and judging from the headers of the "returned" messages they seem to come from one or a few PCs.

So what happens to you is most probably that there is somewhere a PC infected with a Sober email worm, and that had your domain name somwhere on its disk.

William9 · 17 Dec 2005, 12:59 PM

That makes sense. One of my colleages PC's had a worm recently. I'm sure that my email address was on his computer.

15 Dec 2005, 09:41 AM	#1
William9 The "e" in e-mail Join Date: Nov 2005 Location: San Francisco Posts: 2,281	Sober virus I've had a lot of emails with the sober virus removed by FastMail. At least that's the message on some of my emails. I would like to know more about back scatter. I've received many emails from an email server saying that the message I sent couldn't be delivered because it contained the sober virus. The address to me is my domain, but not my username. Is this back scatter? I doubt that I sent the virus because a use a Macintosh for sending messages. Can anyone describe what back scatter is and why I'm receiving messages from another server addressed to "postmaster" or something similar in my domain accusing me of sending a virus laden email?

15 Dec 2005, 11:36 AM	#2
n5bb Intergalactic Postmaster Join Date: May 2004 Location: Irving, Texas Posts: 8,930	Mail Deliver Failure spam This is most probably caused by a spammer spoofing your email address as their return address. Unfortunately, this has become very common. Here are some threads with related comments and ways to filter these messages: spammer with (apparently) fastmail.fm address How to filter out "mail delivery failure" spam? Spam: "Returned" E-Mails

16 Dec 2005, 09:02 AM	#3
hadaso The "e" in e-mail Join Date: Oct 2002 Location: Holon, Israel. Posts: 4,862	What you are getting is most probably email delivery failure messages for email sent by a Sober virus with email addresses in your domain as "From". I get tons of these, and judging from the headers of the "returned" messages they seem to come from one or a few PCs. So what happens to you is most probably that there is somewhere a PC infected with a Sober email worm, and that had your domain name somwhere on its disk.

17 Dec 2005, 12:59 PM	#4
William9 The "e" in e-mail Join Date: Nov 2005 Location: San Francisco Posts: 2,281	That makes sense. One of my colleages PC's had a worm recently. I'm sure that my email address was on his computer.