Help: New Virus Affecting Outlook 2007

M

Mark S. Milley

Hi all -

I'm a bit frustrated right now. I have contracted a virus.

Let me start this email by saying that I am a Microsoft Certified
Solutions Developer; I know my way around a machine. I've also
recovered from quite a few viruses in my life. This one is different.

Secondly, please don't answer with the obvious, and please read the
full email. Try to clear your mind of all known viruses and accept
what I'm telling you is true. I'm asking you to please do that because
as I've searched the web for a solution to this problem, I've seen a
lot of would-be geek heroes abusing the people who are reporting the
problem and coming up with off the cuff half-baked answers that would
have helped if it was some other virus that came out in the last five
years.

This is something NEW. Seriously, I think it's Red-alert time for you
folks at MS who might be reading this.

From what I can tell in my research, this virus started THIS YEAR, and
there are more reports of it in the wild in the past two months.

I'm running on a Sony Vaio with Windows Vista and Outlook 2007.
OneCare is always running, as is Windows Firewall. I host my domain at
Google, which gives me an advantage in diagnosing this problem.

Okay, here is what is going on:

When I issue a send/receive command from outlook (and only then),
Outlook 2007 sends virus emails via though my email account. This IS
the trigger.

In the status bar, Outlook reports the number of emails it's sending
(usually around 50).

However, these emails do NOT show up in the outbox or the sent items
box in the application.

These emails DO show up in the sent box of the account itself (i'm
using IMAP) when I look at it via the web client.

My account was not "hacked"; these are not being sent from a seperate
account. These are being sent via Outlook 2007. I know that these are
not coming from a remote location due to the exact timing of when the
emails get sent corresponding when I hit send/receive, and the fact
that my computer's name appears in the header of the emails.

These emails are NOT being sent to addresses in my outlook address
book; they seem to be coming out of some other database.

There are no unusual programs set to start up when windows starts
(msconfig). There are no odd macros or code inside of outlook. There
are no unusual add-ons active inside of outlook. OneCare's scans and
Malwarebytes have found nothing. I have shut off "receipt responses"
and this is not solve the problem.

This problem began this morning; I have not installed any programs or
received any virus warnings from onecare in the past week.

People have suggested that the problem may be a botnet or rootkit
infection, but have not provided answers on how to fix the problem. I
don't think this is the problem however, because, again, this is
happening exactly when I send an email through Outlook 2007. If I use
windows mail, it's fine.

I'm on the virge of just uninstalling Outlook 2007 and never using it
again.

Suggestions?
 
D

Diane Poremsky [MVP]

What is the content of the sent mails you see in the gmail sent folder?


--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
(e-mail address removed)

EMO - a weekly newsletter about Outlook and Exchange:
(e-mail address removed)

You can access this newsgroup by visiting
http://www.microsoft.com/office/community/en-us/default.mspx or point your
newsreader to msnews.microsoft.com.
 
D

Diane Poremsky [MVP]

Also - when you say it doesn't happen in windows mail, is windows mail set
as your default mail client? If it is a virus, it may be associating with
the default client.


--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
(e-mail address removed)

EMO - a weekly newsletter about Outlook and Exchange:
(e-mail address removed)

You can access this newsgroup by visiting
http://www.microsoft.com/office/community/en-us/default.mspx or point your
newsreader to msnews.microsoft.com.
 
P

Peter Foldes

Mark.

LOL. Known issue. Classic Anti Virus scanning incoming and outgoing emails

Disable the email scanning option on your Anti Virus. Some AV's it is not enough to disable the scanning you need to do the following

If using Norton,MacAfee or Trend then uninstall the AV program and then re-install it without the email integration(scanning)

You should now see the improvement. Let us know
 
B

Brian Tillman [MVP - Outlook]

This is something NEW. Seriously, I think it's Red-alert time for you
folks at MS who might be reading this.

Microsoft people generally don't read these newsgroups. You should open a
support incident if you have a security concern.
When I issue a send/receive command from outlook (and only then),
Outlook 2007 sends virus emails via though my email account. This IS
the trigger.

In the status bar, Outlook reports the number of emails it's sending
(usually around 50).

However, these emails do NOT show up in the outbox or the sent items
box in the application.

These emails DO show up in the sent box of the account itself (i'm
using IMAP) when I look at it via the web client.

My account was not "hacked"; these are not being sent from a seperate
account. These are being sent via Outlook 2007. I know that these are
not coming from a remote location due to the exact timing of when the
emails get sent corresponding when I hit send/receive, and the fact
that my computer's name appears in the header of the emails.

These emails are NOT being sent to addresses in my outlook address
book; they seem to be coming out of some other database.

There are no unusual programs set to start up when windows starts
(msconfig). There are no odd macros or code inside of outlook. There
are no unusual add-ons active inside of outlook. OneCare's scans and
Malwarebytes have found nothing. I have shut off "receipt responses"
and this is not solve the problem.

Several people have reported a problem with Outlook 2007 with "not read"
receipts being sent even when the sending of receipts is disabled. Recipts
don't appear in the Outbox. Microsoft has received notification of this.
Any chance this might be what you're seeing?
 
F

F.H. Muffman

When I issue a send/receive command from outlook (and only then),
Outlook 2007 sends virus emails via though my email account. This IS
the trigger.

In the status bar, Outlook reports the number of emails it's sending
(usually around 50).


I'd love to see a network packet trace of this happening. Feel free to email
one along. You'll probably want to change your passwords before and after
the trace.
 
J

JJOHNSON

I too am experiencing the same with outlook. I have ran numerous virus
scans, symantec included, and none have detected anything. The recipient of
my email also receives the same amount indicated in the sending status bar
(it varies) . Please let me know if you find anything to clear it up.

Thanks,

JJohnson
 
D

Diane Poremsky [MVP]

Is your recipient getting duplicates of the messages you send or getting
spam from you?

--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
(e-mail address removed)

EMO - a weekly newsletter about Outlook and Exchange:
(e-mail address removed)

You can access this newsgroup by visiting
http://www.microsoft.com/office/community/en-us/default.mspx or point your
newsreader to msnews.microsoft.com.
 
D

duggieG

Same thing happening to me.

Vista 64 (ultimate), outlook 2007, gmail with IMAP.
when I logged into Gmail, had several undeliverable emails. I did not
recognize any of the addresses. The emails had headings like 'make all the
girls in the neighborhood long for you.' Email bodies were mostly blank, some
had that all caps code in it. Some emails had Winmail.dat attached. Headers
showed it to come from my desktop computer at my home IP.

Emails also showed in the gmail 'sent' folder, but not in my outlook folder
or anywhere else I looked (mobile windows 6, macbook laptop).

Adaware, malware remover (uh don't think that's the correct name), and avast
antivirus found nothing.

I'm also switching to windows livemail, but would like to figure out what's
up.
 
B

Brian Tillman [MVP - Outlook]

Same thing happening to me.

Vista 64 (ultimate), outlook 2007, gmail with IMAP.
when I logged into Gmail, had several undeliverable emails. I did not
recognize any of the addresses. The emails had headings like 'make all the
girls in the neighborhood long for you.' Email bodies were mostly blank,
some
had that all caps code in it. Some emails had Winmail.dat attached.
Headers
showed it to come from my desktop computer at my home IP.

Emails also showed in the gmail 'sent' folder, but not in my outlook
folder
or anywhere else I looked (mobile windows 6, macbook laptop).

This sounds more like your mail address has been hijacked or your gmail
account compromised than it does a problem with Outlook. The first thing
I'd do is to change my gmail password to something reasonable complex,
including non-alphanumeric characters as well as upper and lower case.
 
D

duggieG

Thanks for your input Brian. Please see the first message in this thread to
verify that some of us have some idea what we're talking about, and that
something else is occurring here.


By the way, I unplugged my ethernet connection and opened outlook - it
immediately tried to send from all my accounts. I deleted the passwords and
left them blank, closed and opened outlook and looked at the status - outlook
reported sending successfully from each account (not possible with unplugged
cable, obviously). I turned off the send/receive on starting option, closed
and opened outlook, same thing, reported successfully sending email from all
accounts.

Others are also having this problem as you can see from the link I posted
above.
 
D

Diane Poremsky [MVP]

From near the bottom of the thread at bleepingcomputer.com, where the poster
posts one of the messages -

Outlook is responding to read receipts - 'not read' means the messages were
deleted unread. This explains the problem:
http://www.slipstick.com/emo/2008/up081023.htm#4 - its definitely not a
virus. Outlook should not be returning read receipts when deleting junk
mail and Microsoft is investigating the problem.



--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
(e-mail address removed)

EMO - a weekly newsletter about Outlook and Exchange:
(e-mail address removed)

You can access this newsgroup by visiting
http://www.microsoft.com/office/community/en-us/default.mspx or point your
newsreader to msnews.microsoft.com.


Diane Poremsky said:
Did you run a packet trace as FH suggested?

--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
(e-mail address removed)

EMO - a weekly newsletter about Outlook and Exchange:
(e-mail address removed)

You can access this newsgroup by visiting
http://www.microsoft.com/office/community/en-us/default.mspx or point your
newsreader to msnews.microsoft.com.


duggieG said:
Thanks for your input Brian. Please see the first message in this thread
to
verify that some of us have some idea what we're talking about, and that
something else is occurring here.


By the way, I unplugged my ethernet connection and opened outlook - it
immediately tried to send from all my accounts. I deleted the passwords
and
left them blank, closed and opened outlook and looked at the status -
outlook
reported sending successfully from each account (not possible with
unplugged
cable, obviously). I turned off the send/receive on starting option,
closed
and opened outlook, same thing, reported successfully sending email from
all
accounts.

Others are also having this problem as you can see from the link I posted
above.
 
B

Brian Tillman [MVP - Outlook]

Thanks for your input Brian. Please see the first message in this thread
to
verify that some of us have some idea what we're talking about, and that
something else is occurring here.

I never said you didn't know what you're talking about, but you just proved
you don't, because that thread at BleepingCOmputer that you said was
"exactly" your problem IS the read receipt issue I suggested.
 
D

Diane Poremsky [MVP]

I'll also point out that the "expert" at bleepingcomputer doesn't know what
they are looking as they continued to recommend solutions (including the use
of a "very powerful tool which should not be used without expert guidance")
in hopes of identifying the "virus", when the sample message posted shows
its clearly not a virus - its an NDR from a read receipt. See
http://www.outlook-tips.net/archives/2008/20081024.htm


--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
(e-mail address removed)

EMO - a weekly newsletter about Outlook and Exchange:
(e-mail address removed)

You can access this newsgroup by visiting
http://www.microsoft.com/office/community/en-us/default.mspx or point your
newsreader to msnews.microsoft.com.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top