PDA

View Full Version : A question for you IT gurus. Anyone had this problem lately?



K7SGJ
02-25-2013, 10:15 PM
As of a week or so ago, my wife has been getting bogus mail delivery failure emails on one of her email accounts she accesses via Outlook. If it was one or two, it wouldn't be a problem, but it is usually 40-60 in the span of less than an hour. They are from x@aol, x@yahoo, x@hotmail, and others I haven't seen before. The account name prior to the @x is never the same twice. There is always an attachment which she never opens on threat of bodily harm. I taught her long ago to never open anything she doesn't recognize, or to ask me if in doubt. I tried talking with our ISP (Qwest, or CenturyLink, or whatever they call themselves this week) and they were about as helpful as a dose of the clapp.

I have run AVG, MS Malicious Tool Removal, and some other things I have around here, to no avail. And, of course, deleting them entirely is of no help as they tend to return again several hours later. I just changed one of the Outlook settings to require secure password login, and see if this helps. It appears to be either a email hijack or a virus or other nasty that has gotten in. She doesn't visit questionable websites, and mainly uses this for her online business; and she has been doing this for years and this is the first time this issue ever cropped up. She runs Win 8 on this particular laptop (and hates it). I have been toying with the idea of putting Win 7 on it since it is more user friendly for non-touch screen applications like this machine. However, if this is coming from outside, changing OS won't fix anything, other than her frustration level trying to navigate her applications. If it turns out that is a virus, worm, TH, or something of that nature, sanitizing the HD and starting over is no big deal, just a time consuming pain in the ass. I may end up doing that anyway to change the OS, but I would like to get a handle on this, whatever it is.

Any ideas or help would be welcomed, and if you have any questions that might help, please let me know and I'll do my best to provide any information needed.

Thanks. I hope you all get laid. I won't till this is fixed, so time is of the essence.

W4GPL
02-25-2013, 10:20 PM
It's very unlikely this has anything to do with her computer. It's more likely that someone she knows is infected with malware and is sending out e-mails as her.. it's a very trivial thing to accomplish. Usually the malware harvests e-mail addresses from the victim's contact list in hopes that there will be a common thread between their contacts and yours.

The fact is.. there's very little you can do about it. It's annoying as hell, all I can tell you is that it will probably stop.. or slow down.. eventually.

N1LAF
02-25-2013, 10:27 PM
One of the problems is using a Microsoft product, like Outlook - a virus magnet. Use web mail, they do a good job filtering this junk. And it doesn't have to be your machine that got hit, you could be victimized by someone else having a problem (an e-mail sent to another person, and that other person was hacked, picking up your(her) e-mail address. Since I use web mail exclusively, I never got hit with bogus e-mail(infecting my system).

Beware of Microsoft products!

N1LAF
02-25-2013, 10:27 PM
It's very unlikely this has anything to do with her computer. It's more likely that someone she knows is infected with malware and is sending out e-mails as her.. it's a very trivial thing to accomplish. Usually the malware harvests e-mail addresses from the victim's contact list in hopes that there will be a common thread between their contacts and yours.

The fact is.. there's very little you can do about it. It's annoying as hell, all I can tell you is that it will probably stop.. or slow down.. eventually.

What Jeff said... what I was trying to say..

W4GPL
02-25-2013, 10:32 PM
What Jeff said... what I was trying to say..I don't at all agree with your web mail comments, however.

N1LAF
02-25-2013, 10:40 PM
I don't at all agree with your web mail comments, however.

That's ok. My position is why download questionable content to your computer. Web based mail clients holds the e-mail, and you download what you want and know safe. I don't agree with anti-webmail sentiment. I use web mail through XO (my host site), I have safe mail lists and junk mail lists, anything that is tagged junk, sits in the junkmail inbox for 7 days, and is automatically washed out. XO mail may be more elaborate than Yahoo. I would not trust any Google products.

W4GPL
02-25-2013, 10:43 PM
All of that is true with my e-mail too, Paul -- and I don't use web mail. Nor did I say I was anti web mail, I just disagree that it's some how more secure. All mail is still coming in to the provider's server via SMTP and then can still be scanned just as web mail is (by the provider). And if you want to avoid downloading things to your computer, you can use IMAP as the client and defer attachments entirely.

N1LAF
02-25-2013, 10:48 PM
All of that is true with my e-mail too, Paul -- and I don't use web mail. Nor did I say I was anti web mail, I just disagree that it's some how more secure. All mail is still coming in to the provider's server via SMTP and then can still be scanned just as web mail is (by the provider). And if you want to avoid downloading things to your computer, you can use IMAP as the client and defer attachments entirely.

I suppose it is all in the implementation. All graphics, images are not displayed unless I click on it. This way, there is no image link to flag the spammer site that their message was received. I choose what to download for attachments, and reject the rest. For me, it is easier to handle. Delete spam/junk (rare occasions that may get through) right from the host server. Matter of preference, I suppose.

W4GPL
02-25-2013, 10:53 PM
All graphics, images are not displayed unless I click on it. This way, there is no image link to flag the spammer site that their message was received. I choose what to download for attachments, and reject the rest.Again, all of that is true for a regular client side e-mail client.


Matter of preference, I suppose.Matter of preference, yes. Matter of security? No.

KJ3N
02-25-2013, 11:20 PM
Any ideas or help would be welcomed, and if you have any questions that might help, please let me know and I'll do my best to provide any information needed.

I'm not sure I understand the problem, so bear with me.

If I understand it correctly, it's not spam coming from those addresses, but the ISP's server telling her the addresses are not valid? If so, it sounds like the password on that one account has been compromised.

Have her change the password on that account and see if the messages stop.

W4GPL
02-25-2013, 11:35 PM
I think you're misunderstanding him.

Check your e-mail, Jim.. I just demonstrated to you what's happening to him. You could have a bounced e-mail in your inbox that should appear like it was sent from you.

KJ3N
02-25-2013, 11:46 PM
I think you're misunderstanding him.

Check your e-mail, Jim.. I just demonstrated to you what's happening to him. You could have a bounced e-mail in your inbox that should appear like it was sent from you.

I see what you did, but I'd like to see one of the original messages Eddie is getting.

My wife had a similar situation with one of her email accounts and a simple changing of the (somewhat weak) password stopped it.

NA4BH
02-25-2013, 11:46 PM
I see what you're talking about now. That crap happens here often. I hit the delete button very fast. It comes and goes in frequency.

K7SGJ
02-26-2013, 09:55 AM
Thanks for the help, everyone. I'll have her use the web mail for awhile and see where this goes.

W3WN
02-26-2013, 02:16 PM
As of a week or so ago, my wife has been getting bogus mail delivery failure emails on one of her email accounts she accesses via Outlook. If it was one or two, it wouldn't be a problem, but it is usually 40-60 in the span of less than an hour. They are from x@aol, x@yahoo, x@hotmail, and others I haven't seen before. The account name prior to the @x is never the same twice. There is always an attachment which she never opens on threat of bodily harm. I taught her long ago to never open anything she doesn't recognize, or to ask me if in doubt. I tried talking with our ISP (Qwest, or CenturyLink, or whatever they call themselves this week) and they were about as helpful as a dose of the clapp.

I have run AVG, MS Malicious Tool Removal, and some other things I have around here, to no avail. And, of course, deleting them entirely is of no help as they tend to return again several hours later. I just changed one of the Outlook settings to require secure password login, and see if this helps. It appears to be either a email hijack or a virus or other nasty that has gotten in. She doesn't visit questionable websites, and mainly uses this for her online business; and she has been doing this for years and this is the first time this issue ever cropped up. She runs Win 8 on this particular laptop (and hates it). I have been toying with the idea of putting Win 7 on it since it is more user friendly for non-touch screen applications like this machine. However, if this is coming from outside, changing OS won't fix anything, other than her frustration level trying to navigate her applications. If it turns out that is a virus, worm, TH, or something of that nature, sanitizing the HD and starting over is no big deal, just a time consuming pain in the ass. I may end up doing that anyway to change the OS, but I would like to get a handle on this, whatever it is.

Any ideas or help would be welcomed, and if you have any questions that might help, please let me know and I'll do my best to provide any information needed.

Thanks. I hope you all get laid. I won't till this is fixed, so time is of the essence.Actually, a dose of the clapp might have been more helpful.

I've seen this before. It's definitely spam or phishing attempts. The emails have been crafted to resemble bounce messages, social engineering to fool you into opening them.

Sadly, there's not much you can do on your end except to continue deleting the bolshoi emails. The spammers are clever enough to constantly change the bogus email domain, so blocking one domain or address won't stop the next one from coming in.