It is currently Tue Sep 01, 2026 1:49 pm


Mail Returned, but I did not send.

Discuss security related topics in here (Hacking, Cracking, and Protecting)
Do not post HJT Logs here

Moderator: PCguy

Mail Returned, but I did not send.

Postby PCIdjit » Tue Apr 19, 2005 3:20 pm

Greetings all. (If this has been addressed already, please link to posting)

I have an older PC and this just started yesterday. I have recieved two e-mails, both from Postmaster@cox.net indicating that the recipients did not recieve the messages due to User Unknown or no account with that particular ISP. (both different by the way)



Problem is I did not e-mail these people.

I have McAfee firewall and anti-virus with current updates, set to run automatically while on-line. I have current updates of Spy-bot, Adaware etc. that I run with a religiously obsessiveness. I run windows2000 and have all the current critical updates installed.

This PC runs AOL 6.0. :mad: I checked the mail feature and the "sent" mail is empty of any unknown "sendees".

The research I did on this indicates that, to the best of my knowledge, someone got my e-mail address from somewhere and is using it as the "From" name, and that my ISP account should not be compromised. But it is vague on what I should do (if anything).

Do I contact my ISP? Do I contact the Mail Administrator (Postmaster@cox.net) who is returning the mail? My first paranoid reaction was to cancel (and restore it later) the account name with my ISP. But if the account is not compromised, will that do any good?

One coincidence I have found is that last Friday (4-15) I recieved an e-mail from a member of a gaming forum that I frequent. I read the mail but did not open any attachments nor click on any links. His address is "his name"@COX.NET. Too much of a coincidence for me, but I can't be sure. My guess is that he probably has an "e-mail name harvester" on his PC, which is where my name got "hijacked".


Thanks for any answers or advice you can give. :cool:
User avatar
PCIdjit
Newbie
Newbie
 
Posts: 13
Joined: Fri Jun 04, 2004 1:00 am

Thanks given:0
Thanks received:0
Top

Postby icecube » Wed Apr 20, 2005 6:05 am

Probably what happened is that someone who has an email from you, got nailed by a virus and your email was one of those used by the virus to send out messages on the infected user's system.

Sometimes, you'll also be informed in the returned message that an attachment was deleted--the payload.
User avatar
icecube
Moderator
Moderator
 
Posts: 1209
Joined: Wed Mar 10, 2004 1:00 am
Location: San Marcos Ca

Thanks given:0
Thanks received:0
Top

Postby badpolarbear » Wed Apr 20, 2005 7:11 am

If you still have the emails you can view the messege source and find out the originating IP address, use a program such as NeoTrace to trace the IP and report to the system administrator that this person is sending emails using your address.

If you dont mind me asking, do you get emails and just forward them on to other contacts? If so you are not only putting yourself at risk but if there is a list of email addresses that goes with it, they too are at risk. Sending forwards with multiple addresses is a spammers heaven.

Which particular email program is this happening with? Outlook Express, Hotmail, Yahoo Mail? If you tell us we may be able to set you up with something that will help protect you a little better. You might consider using gmail. If you would like a gmail account, there are a few people here who have invitations. Im sure if you ask one of us that has them, we would be happy to set you up.
User avatar
badpolarbear
Executive Geek
Executive Geek
 
Posts: 667
Joined: Mon Feb 23, 2004 1:00 am
Location: Barrys Bay Ontario

Thanks given:0
Thanks received:0
Top

Postby PCIdjit » Thu Apr 21, 2005 4:43 am

Thanks for replying.

!!!!!!!!!!UPDATE!!!!!!!!!!!


I contacted my ISP and after several "are you sure?" questions from me, they assured me that my account was not compromised and that it was a spammer "spoofing" the TO and FROM names on the email.

Of course, I believe them whole-heartedly :| they wouldn't lie to me, one of their best customers.... :cool: ................................would they?......... :|

They said to send the email in question to the TOS dept. and then delete it from my mail box.


Oh, well..........I WILL COMPLY.............. :lol:




And I really appreciate the offer for the gmail thingy. Really I do.

But I am currently in the process of getting a new PC and changing over to a new ISP, etc., etc.

BUT.......when I do, don't be suprised if I take you up on that offer! :P


Thanks again!
User avatar
PCIdjit
Newbie
Newbie
 
Posts: 13
Joined: Fri Jun 04, 2004 1:00 am

Thanks given:0
Thanks received:0
Top

Postby icecube » Thu Apr 21, 2005 7:28 am

I hope if you get rid of anything, its AOL---your paying for T1 service with Cox and paying AOL also --thats a heavy load. I don't really care for AOL because they update their software without your permission. When that happens, and, say they made a mistake, your computer does not behave well afterwords, they won't say a peep! Thats 20 million people all in one whack.

For example their free Mcafee virus scan program. If you were running Norton, you were locked out of your dial up if you installed it--neat huh?

They also censor newsgroups. You won't get a full list---80% maybe
User avatar
icecube
Moderator
Moderator
 
Posts: 1209
Joined: Wed Mar 10, 2004 1:00 am
Location: San Marcos Ca

Thanks given:0
Thanks received:0
Top

Postby PCIdjit » Thu Apr 21, 2005 1:11 pm

User avatar
PCIdjit
Newbie
Newbie
 
Posts: 13
Joined: Fri Jun 04, 2004 1:00 am

Thanks given:0
Thanks received:0
Top

Postby PCguy » Thu Apr 21, 2005 2:19 pm

(\__/) This is Bunny.
(='.'=) Copy and paste bunny into your sig.
(")_(") Help Bunny gain World Domination.

Image
User avatar
PCguy
Lord of the Geeks
Lord of the Geeks
 
Posts: 2017
Joined: Sat Sep 15, 2001 1:00 am
Location: A Very Scarey Place
Operating System:

Thanks given:2
Thanks received:4
Top

Postby bjproc » Wed Apr 27, 2005 6:27 pm

I have invites for GMail if you want one.
Bj
User avatar
bjproc
Geek
Geek
 
Posts: 55
Joined: Mon Mar 07, 2005 1:00 am
Location: Forfar, Scotland

Thanks given:0
Thanks received:0
Top


Return to Security

Who is online

Users browsing this forum: No registered users and 1 guest

cron