Warning! Virus Attached (Maybe)

The last message you want to see in your e-mail inbox is an urgent alert saying your computer has been infected with a virus.

In August, when I received just such a message, my first reaction was denial: It just can't be. After all, I use a firewall and keep Windows and Norton AntiVirus up-to-date. After thinking about it for a few seconds, however, I suspected that the e-mail warning might itself lead to a virus.

That's one technique virus-writers have been known to use. They tell you you're infected and offer you a link to a program that's designed to cure the specific virus your computer has supposedly contracted. But, in fact, if you download the program, you're downloading a virus. Aware of this trick, I ignored the alert.

The next day, Brother Craig downloaded our e-mail and a whopping 216 messages came in first thing in the morning. Two hours later, another 200 arrived. As I scrolled through the messages, I found most were returns to me from automated mail servers saying that my e-mail, having been judged “infected,” was being rejected by the computers I'd sent it to. My outgoing mail was being returned to me as undeliverable.

These e-mails supposedly sent by me all came with an attached file. The message told me I had to open the attachment to get the details on why my outgoing mail was being returned to me unopened. I looked at the “From” line in the e-mail header and, sure enough, there was our e-mail address, [email protected].

Resisting the urge to worry, I scanned my computer for viruses with Norton, the popular anti-virus program. I was actually hoping Norton would come up with something just so I would know it was doing its job. But the computer received a clean bill of health.

I was a bit stumped at this point. Was it possible that a new virus had been developed that Norton couldn't detect? If so, what could I do about it? I looked in the e-mail header for “what” had sent the e-mail. It said Outlook Express and gave the version number. I quickly checked all our computers. None of them had this version of that program. Perhaps we weren't infected after all.

Then things took a turn for the worse. We were using a free e-mail service provided by Catholic Online (www.catholic.org) and downloading our e-mail from their service. This way our real e-mail address with our Internet provider remained hidden; if we changed Internet service providers, our contact e-mail address could remain the same. However, like most free services, Catholic Online limits the amount of space you can take up with your free e-mail account.

As I said, we were getting on average 100 e-mails an hour, most with attachments. Unless we kept pulling the e-mails off Catholic online, we would certainly go over quota, thereby freezing up our e-mail account. I tried downloading our e-mail periodically — until one got “stuck.” Our computer wouldn't download it. Now if one e-mail gets stuck, even though you download all the other e-mails, none of them get deleted from the Catholic Online account. So I decided to use Catholic Online's Web-based e-mail handling system. I tried to delete the e-mails and they wouldn't go away. So I knew that our e-mail account would be frozen in a matter of hours. Sure enough, that's just what happened next.

My first break came when I closely examined the e-mails I had already downloaded. One of them, thanks be to God, actually told me the name of the virus I supposedly had: W32/Sobig.F@mm. Now here was information I could do something with. I could look up this virus in the Norton virus database. Here's what I learned.

W32.Sobig.F@mm uses a technique known as “spoofing,” by which it randomly selects an e-mail address it finds on an infected computer. The searching “worm” uses this address as the “From” address when it performs its mass-mailing routine to other addresses in the infected computer. Now I'm sure several people have our e-mail address in their computer-address books. One or more of these persons was now spreading this virus — and it looked like it was coming from us. I received a little consolation when I read that the virus would deactivate itself on Sept. 10. At least an end to the madness was in sight!

I believe this latest virus threat has started a new, malicious trend impossible to defend against. Even though our computers were protected, Sobig still shut down our e-mail address. Imagine if this virus decided to send people to pornographic sites in our name. How long would it take us to recover from that?

It is worthwhile to protect from these types of viruses by never using your primary e-mail address. Set up your contact e-mail address so that it isn't the address assigned to you by your ISP. Then, if what happened to me happens to you, just cancel the e-mail address account.

Getting your ISP to change your assigned primary e-mail address could be more of a hassle. A contact e-mail address can be set up with a free e-mail service provider like Catholic Online at catholic.org. Or if your ISP enables you to set up more than one e-mail account, do so and never give out your primary one.

If this sounds like a bit of a bother, that's because it is. But it's much less trouble to be proactive and protective now than reactive and recovering later.

Brother John Raymond, co-founder of the Monks of Adoration, writes from Venice, Florida.