WAYS OF INFECTION
Mail bombers are not viruses and therefore cannot propagate by themselves and must be controlled by certain persons. They can be installed as any other software with or without user content. There are two major ways unsolicited mail bombers can get into the system.
1. A legitimate mass-mailing program can be manually installed by system administrator or any other user who has sufficient privileges for the software installation. A hacker can break into the system and setup own malicious mail bomber. In both cases a privacy threat gets installed without the affected user’s knowledge and consent.
2. Mail bombers often get installed by other parasites like viruses, trojans, backdoors or remote administration tools. They get into the system without user knowledge and consent. Such mail bombers do not have any uninstall functions and can be controlled only by their authors or attackers.
Malicious mail bombers work mostly on computers running Microsoft Windows operating system.
WHAT A MAIL BOMBER DOES?
- Sends excessive amount of anonymous e-mail messages with spam, advertising or any other content.
- Overloads mail servers and user computers by sending numerous e-mail messages with extremely large files attached.
- Degrades Internet connection speed and overall system performance and causes software instability.
- Crashes computers flooded with thousands of e-mails or causes Internet connection loss.
- Provides no uninstall feature, hides processes, files and other objects in order to complicate its removal.
EXAMPLES OF MAIL BOMBERS
Malicious mail bombers and legitimate mass-mailing programs are not widely spread threats and all have practically identical functionality. The following examples illustrate typical mail bomber behavior.
KaBoom! and Avalanche are popular mail bombers that flood user computers with excessive amount of anonymous e-mail messages and spam. They are one of the most effective and widely used mail bombers ever.
Aenima is an effective, fast and easy-to-use mail bomber designed to send large amount of anonymous e-mail messages and spam. This parasite can be used to flood certain computers, overload mail servers or local network. Aenima can send e-mails with different header, body or attached files. The parasite doesn't distribute itself and must be manually installed. Its presence in the system indicates that a computer was compromised and now is used as an illegal mail server to deliver spam.
CONSEQUENCES OF A MAIL BOMBER ACTIVITY
Although mail bombers may look as relatively harmless threats, their activity can result in really catastrophic consequences. Even a single mail bomber can take out a mail server of a typical Internet service provider. ISP clients would be unable to receive and send any e-mails all the time during the attack and long time after it has finished. Regular home or office computers, if flooded directly, can encounter critical performance and Internet connection slowdowns and therefore may crash.
Malicious persons can install a mail bomber on already compromised system and use it as an illegal mail server to send spam. The user, on which computer a mail bomber is installed, can be accused of criminal activity, as in some countries spam delivery is a serious criminal offence.
Mail bombers pose threat to user privacy. They often send undesirable e-mail messages with links leading to potentially dangerous Internet resources or spyware infection sources. Inexperienced and unaware users may follow such links and get parasites installed to their systems.
HOW TO REMOVE A MAIL BOMBER?
Some malicious mail bombers can be found and removed with the help of effective antivirus products like Symantec Norton AntiVirus, Kaspersky Anti-Virus, McAfee VirusScan, eTrust EZ Antivirus, Panda Titanium Antivirus, AVG Anti-Virus. Nevertheless, most mail bombers have nothing in common with viruses and therefore must be manually uninstalled. However, not all these programs have functional uninstall feature.
2-Spyware.com provides manual mail bomber removal instructions that allow the user to manually delete all the files, directories, registry entries and other objects that belong to a threat. However, manual removal requires fair system knowledge and therefore can be a quite difficult and tedious task for novices.