Mail Hijack?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Thu May 24, 2007 5:14 pm

OK, I'm not too tech savvy so I could do with a little help with this.

Yesterday I noticed a bounced email in my mailbox. Didn't recognise the outgoing address so I had a closer look. Turned out to be one of these chain type emails- lots of random words & what appears to be a .gif attachment.

The email address is one provided by my ISP & takes the form [email protected]. POP3 server requires login, but SMTP server doesn't. The 'myname' bit had been replaced by a random name. Header gave these IP addresses:

Quote:

194.217.242.95
213.146.137.36
212.125.75.12
75.139.131.125
75.139.131.125
136.160.89.74
75.139.131.125
7.1.0.9

(I know the last one's spurious). None of these is my actual (static) IP address. Just to be on the safe side, I disabled the smtp server. Today there are another 5 undeliverable emails - presumably getting rid of the smtp server stopped them from being delivered?

What I need to know is:

a) How?
b) What's the best way of stopping it?

Hardware wise, my machine is a G4 iMac, OS 10.4 (with latest updates). I've a wired network consisting of this, a G3 iMac (OS 10.3), a Windows XP PC & finally a Windows XP laptop - this last one is also equipped with a wireless card. The 2 iMac's both have the standard Apple firewall enabled. The laptop (daughter's) didn't have the firewall enabled.

Any suggestions?

Posted: Thu May 24, 2007 5:23 pm

^^^which email client are you using (mail or Thunderbird)?

Posted: Thu May 24, 2007 5:26 pm

Thunderbird.

Posted: Thu May 24, 2007 5:30 pm

Windows Laptop without firewall automatically starts alarm bells ringing. Can you simply use your email prefs to block incoming from the addresses the suspicious emails came from (and turn on the laptop firewall if your router doesn't have one)
I do know that Thunderbird did (does?) have some security issues with SMTP and down-negotiation, maybe a good time to swap to Thunderbird 2.

Posted: Thu May 24, 2007 5:43 pm

Quote:

Can you simply use your email prefs to block incoming

there's nothing showing as incoming - except when the mail was undeliverable & I received a notification from the intended recipient. None of these mails have appeared in either my sent or received boxes. Didn't know Thunderbird 2 (Virgil? Very Happy

) was out. Think it's time for an upgrade - still on 1.5. Daughter's been given strict instructions that firewall remains ON at all times!

Posted: Thu May 24, 2007 5:58 pm

Mike:

Full virus scan with most recent update you can find. Here at work when we find this kind of thing happening it is because someone got a virus that zobified their computer. RUN A FIRE WALL AND VIRUS PROTECTION AT ALL TIMES.

Posted: Thu May 24, 2007 6:26 pm

For total piece of mind The Man is right, PC wise there are loads to choose from. For the Mac I recommend http://www.clamxav.com/

Posted: Thu May 24, 2007 7:22 pm

@iMike

That's not a bounced email. It's just spam that's made to *look like* a bounced email.

My compi is super clean and is definitely not sending anything out and I still get about 20 of those every day.

Delete them and drink a cold beer.

Posted: Thu May 24, 2007 7:36 pm

^^^ light's just begun to dawn - that particular email account's only been given to a very few people, yet recently it's been crawling with spam. One of the people who I gave it to started sending me 'joke' chain emails. Wonder if it's possible her machine's been infected with something?

Anyway, it's been a wake-up call. Upgraded Thunderbird & now got ClamXav running.

thanks for the input.

Baiting Guru Joined: 04 Jan 2006 Posts: 3193

Someone's PC is infected and it picked your name out as the disguise to hide behind. It sends out mail with a spoofed sender. I get loads of these every day. It's nothing to get worried about. If you got the full header in the bounce message it is usually possible to trace it back to the real sender.

In this case it's spam, but what's more annoying is when it's a virus sending itself out the same way. The anti-virus filters send you a message to say they found a virus when they know perfectly well you did not send it.

Posted: Thu May 24, 2007 9:02 pm

The alternative is that somone has been sending spam and using your email address as the sender address.
I had it happen to me. But I have DNS control and simply set all bouncing emails to be redirected to the owner of the site that had used my address for the spamming.
In the course of two days, Mr spammers sales@ address received over 4,000 bounced emails.

Lucky Ruskie...

Posted: Thu May 24, 2007 10:56 pm

the bouncing emails could be the spam too.
I get a lot into my university account, never from my address or to it.