o/t-Spam

[Toolfab]

I have a problem and was courious if anyone has heard of this. I probably should first state that I am a licensened MC V9 user, and hang out in here alot. I don't contribute because I am still relitivley new to the software, but learn a great deal from all of you. I got spamed. http://www.mobile-phone-shield.com/ some how got my personal email address and is using it to send out spam mail. I get about 75 "undeliverable" messages returned to me daily. There is a vast amount of knowledge in this forum, so I thought I would give it a shot. How does this happen, and what can I do to prevent it.

 

Thanks Again.

[jeff]

Change your email address.

[Toolfab]

lmao

 

Thanks for the help Jeff!

 

Anyone else!

[Rekd™]

Toolfab, if you're getting emails that say a message was un-deliverable, that means that YOUR MACHINE is the one sending out the emails, not recieving them. This can mean a few things... the most likely is that someone put a program,(virus?) on your computer to make it send out emails. Open the emails you get and look at the headers to see if their TO names are in YOUR address book.

 

Are you running current Virus Definitions?

 

'Rekd

[Toolfab]

I have done that, completely up-to-date on my Nortan anti virus, no infected files. Checked the returned email's in the FROM: section it has my email address but someone elses NAME. And I have called most of my friends to see if they are getting weird stuff from me, none of them are. The messages are sent to 15 people at a time, and NONE of them have been from my address book. Looks like they use my address attach there list and send it out so it is untracable. That way when people block the address that is sending them spam block me then next month the little bast@#$ will change who they r using and send it out agian.

[Guest]

Toolfab:

 

There is not much you can do. My wife had the same thing going on with her email address. I talked to our email provider and he informed me that just about anybody can send an email with a different return address. Your only response is ignore them or change your address.

[Rekd™]

Mark is right. You've got a field in your Options somewhere that says RETURN address, where you can type ANY address you want. The best thing to do in this case is, again, look at the source and see if it tells you who it actually came from, not just the reply to address. Then contact them and ask them to change it. To view the header source, (I'm using Outlook, it should be something simular for you), open the message, click VIEW, then OPTIONS. This should open a window. Look for something called INTERNET HEADERS, and that's where you'll find all the tracking info. You can copy that and post it here if you have trouble locating the culprit and I'll see if I can find it for you.

 

'Rekd

 

[ 12-26-2002, 05:44 PM: Message edited by: Rekd ]

[jspangler]

Hi

We get AT LEAST 20 of those a day here. I think it's probably just a new way of getting you to open infected mail like " a funny new game for you" or "I send this file for your advice".

 

delete 'em. better yet, set up a mail action so it deletes them automatically.

 

John

[Toolfab]

Here it is REKD, larsonpk is me, I don't know anyone else in this mess. And I have NO IDEA what any of this means.

 

This is great, Thank you very much

 

 

This message is not flagged. [ Flag Message - Mark as Unread ]

 

X-Apparently-To: larsonpk@*****.com via 66.218.93.186; 26 Dec 2002 08:10:54 -0800 (PST)

Return-Path: <>

Received: from 137.192.180.33 (EHLO smtp1.onvoy.com) (137.192.180.33) by mta163.mail.scd.yahoo.com with SMTP; 26 Dec 2002 08:10:53 -0800 (PST)

Received: from northstartek.com (ply13-97.nas.mr.net [137.192.59.97]) by smtp1.onvoy.com (8.12.5/8.12.5) with SMTP id gBQG9Ybr008922 for ; Thu, 26 Dec 2002 10:10:48 -0600 (CST)

Date: Thu, 26 Dec 2002 10:08:33 -0600

From: "Mail Delivery Subsystem" | This is Spam | Add to Address Book

Message-Id: <[email protected]>

To: larsonpk@*****.com

MIME-Version: 1.0

Content-Type: multipart/report; report-type=delivery-status; boundary="UQA27565.1040860800/mx1.northstartek.com"

Subject: Returned mail: User unknown

Auto-Submitted: auto-generated (failure)

Content-Length: 1225

 

 

 

The original message was received at Thu, 26 Dec 2002 10:08:33 -0600

from dsl-200-67-138-101.prodigy.net.mx [200.67.138.101]

 

----- The following addresses had permanent fatal errors -----

(expanded from: )

 

----- Transcript of session follows -----

mail.local: unknown name: diehl

550 ... User unknown

 

Message/delivery-status

 

Reporting-MTA: dns; mx1.northstartek.com

Received-From-MTA: DNS; dsl-200-67-138-101.prodigy.net.mx

Arrival-Date: Thu, 26 Dec 2002 10:08:33 -0600

 

Final-Recipient: RFC822;

X-Actual-Recipient: RFC822; [email protected]

Action: failed

Status: 5.1.1

Last-Attempt-Date: Thu, 26 Dec 2002 10:08:33 -0600

 

Forwarded Message [ Save to my **************** | Download File ]

Return-Path:

Received: from 137.192.180.42 (dsl-200-67-138-101.prodigy.net.mx [200.67.138.101]) by pop2.onvoy.com (8.12.1/8.12.1) with SMTP id gBOKD0ur014376 for ; Tue, 24 Dec 2002 14:13:01 -0600 (CST)

Received: from [164.20.126.138] by 137.192.180.42 with ESMTP id PARTZL; Tue, 24 Dec 02 14:10:52 +0400

Received: from [253.6.235.154] by 164.20.126.138 with ESMTP id YQDYNN; Tue, 24 Dec 02 14:01:52 +0400

From: "Ashlee Temple"

Message-ID:

To: [email protected]

Date: Tue, 24 Dec 02 14:01:52 GMT

X-Priority: 3

X-MSMail-Priority: Normal

Subject: do mobiles phone cause cancer? fHzRhvEH

X-Mailer: Microsoft Outlook, Build 10.0.2616

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary=XTGSJHEBKHNFELUIHYFYQHY

[aberent]

It's been a while since I did this so I may be a little fuzzy on the logic. In your list of Contacts, add a contact Fullname: !000 and File as: !000 and E-Mail: WormAlert. In theory, any worm will try to send to this contact first, and fail. Then it should abort. I'm not sure if it can be set to send a warning message to your IT Dept. or not. Hope this helps.

[Toolfab]

I do have !0001!virusalert in my address book. These messages are not going out to MY address book, they are going to email's that I have NEVER SEEN before. That is what is so damn frustrating. If they were going to my address book, then I would know I had a "worm" but I don't.

[Christian Raebild]

quote:

---

Received: from [253.6.235.154] by 164.20.126.138 with ESMTP id YQDYNN; Tue, 24 Dec 02 14:01:52 +0400

---

This gives the apparent origin of the spam e-mail as IP 253.6.235.154, but that IP is in an "IANA Special Use" group, so no e-mails should be coming from that IP (except perhaps if you work for IANA). Since this shows that the e-amil header is forged, I doubt anyone can track down the spammer who is using your e-mail address, but you could contact your ISP, and ask them for their advice. Most likely, their advice will be "change your e-mail address".

 

I know that is not much help, but that is the best I can do.

 

An easy and free way to effectively report spam to the appropriate parties can be found at www.spamcop.net, but you "undeliverable" reports are not actually spam, they are a byproduct of a spammer using your e-mail address. A spammer who is clearly violating a number of laws.