Sending spam when machine switched off?

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View
Dear Community,

       Firstly let me explain that my back-ground is in solution
development so I do not have much of a real understanding in security
issues. I have been asked by one of my clients to investigate why he
seems to be getting hundreds of bounce-back emails in his email inbox
every morning. The email headers indicate that the original message was
posted from his pop3 btconnect email account that he has with his ISP
[btconnect].  He accesses his email via outlook express which pulls the
emails via his email account details. I can access this pop3 through
the ISP browser interface, but the account appears empty, and I assume
this is because the emails are removed once they are transferred to
local pc via outlook express.

I started by installing and updating McAfee security centre which I
then used to scan the clients pc for offending viruses, but the
client's pc was clean. I then ensured that the pc was up-to-date with
Microsoft Updates and security patches. I then entertained the idea
that the pop3 account may have been Hi-jacked and changed the account
password for his pop3 account and replicated the new password in his
outlook to ensure his email continues to be downloaded.

I then took a closer look at the header information for the bounced
email accounts which indicated that the original email accounts were
being transmitted at around 1am in the morning; however the client
turns his machine off religiously at closing of play everyday. So if
the pc is switched off, how is it possible that his account sends spam.

I'm now entertaining the idea that the btconnect servers may be
affected by a Trojan email virus of some form or another. I've simply
run out of ideas. I've phoned btconnect and they deny any possibility
that a virus may exist on there servers.

So how is it possible that my clients email account is being used to
transmit span when his machine if off?

Any help gratefully received!



Re: Sending spam when machine switched off?

Quoted text here. Click to load it

Why of course, one can use any valid email account on an email server
from another machine to send email or spoof an email address.

Duane :)

Re: Sending spam when machine switched off?

So ... Duane ... do you believe that someone is posting spam using my
clients address as a spoof address ?


Re: Sending spam when machine switched off?

In article <1164636073.089382.169120>,
Quoted text here. Click to load it
Yes, he does. So do I. It's common.

Re: Sending spam when machine switched off?

On 27 Nov 2006 02:23:52 -0800 Caspian wrote:

Quoted text here. Click to load it
Forging the return address in the 'From:' field is trivial, anyone can do it
and it's a common spammer trick.  There isn't much you or your client can do
about it except to delete the bounces and wait it out, it will be someone
else's turn tomorrow.  

There's also the remote possibility of a 'joe job',
< if your client has annoyed someone.
Ernie B.

Communication:  The art of moving an idea from one mind to another, hopefully
without distortion.

Site Timeline