Articles

Metasploit Framework Windows Tutorial
Remote Desktop Connection
Windows Processes That May Be Dangerous
How-To use NetCat a Tutorial
Common Linux Commands
Common Ports
Netcat Commands
HTTP Response Codes
War-Google Hack Terms
Wardriving
Avoiding Social Engineering and Phishing Attacks
Intrusion Detection on Linux
Linux Intrusion Detection
Penetration Testing Guide
Penetration Testing Tools
Social Engineering Fundamentals, Part I: Hacker Tactics
Social engineering (computer security)
The Psychology of Social Engineering

The Archives

General GSO
GovernmentSecurity.org News & Suggestions
In The News
Open Topic
General Security Information
Trash Can
Exploit & Vulnerability Mailing List Archives
Trial Member Forum
Product and Program Reviews GSO Tutorials
System Security
Windows Systems
Beginners Section
Linux & Unix Systems
File Downloads
Exploit Research & Discussion Trojan & Virus Errata
Networking Security / Firewall / IDS / VPN / Routers
System Hardening
E-Mail Security
Wifi Security
Trial Member Uploads
Upload discovered Trojans & Mal ware
GSO Programming Section
C , C++ , VC++
Visual Basic.NET
Perl /CGI
Java/Javascript
PHP/XML/ASP/HTML
Assembly + Other
The Cork Board
Network Security Consultant Directory
Network Security Jobs
The Archives
Encryption Information
General Network Security
Internet Anonymity
HTTP Protocol Security
Linux Security
MS IIS Information
Exploit Articles
Programming / Tool Design
GSO Software Projects
Public Downloads
Microsoft Security Questions and Papers

Full Version: Returned Mail
BBWolf
Hi!

I get a lot of spam to my e-mail adress, but fortunately, most get stucked in my email's provider spam filter. But a new problem appeared. Lately, I get a lot (more than 50/day) message delivery notifications - undelivered mails. The mails are mostly undelivered spam messages, but the spam filter would not recognize them. (I asked my email provider to temporarily disable my email account, so I could use it, after spam senders stop sending me mail, but they just advised me to use their spam filter - which I alredy did unsure.gif ). So, does anybody know, what does it mean - are those mails some kind of spam, or maybe spam senders somehow use my e-mail adress? (I get those mails even when I'm not connected to internet, so I know it's not coming from my computer...)
Partizaan
Maybe a virus ?
Axl
QUOTE
I get those mails even when I'm not connected to internet, so I know it's not coming from my computer...

so no,no way thats a virus...
well i had the same problem,and im using gmail...
try to block the sender and the reciever of the unsent mail(does it specify the thr sender is you ?

and can you post one of these messages here plz ? i would like to take a look at it.
Erra
I have seen this before.

Have a look in your process list for weird named files.. ones that are just some letters... then, do a start->run and type MSCONFIG and go to the startup section and see if those same files are listed there. (Or check there for anything weird.)

Stop them from loading on startup and then search for the files and delete them.

This may not be the case in your case, but it was when I last came across it, and AV didnt find the files. The only thing that gave it away was all the incoming failed messages to emails that I never sent emails to......

They could be coming from your machine even though your machine is off... because it sends so many at once, it can take a while for the returns to come back. And they will keep coming back even when the machine isnt on.

Good luck!
r4d14t10n
Hmmm if there is any attachment....like bank.rar ...or something like that ...it could be fake mail from virus like MyTob (hellbot) ...first version of this cirus had a bug.....and it sended over and over to same mails....so its possible that it found ur mail on ur computer ...and its sending it to u....
sabrodiesel2000
ok they are fake emails usually coming with attachments like *.pif or *.rar or *.bat. i would recommend NOT to click those files or reply to those emails from whatever addresses they arrive from.
BBWolf
The returned mails are from different mail providers, some with attachments, some not. The attachments are usual spam mail. I get those mails on two computers, but now you mentioned it... It is possible I get them a lot more when I'm using one of them, so maybe there really is some kind of virus on it... I'll check. Thanks guys!
exp0sed
QUOTE(BBWolf @ Jul 9 2005, 11:10 PM)
The returned mails are from different mail providers, some with attachments, some not. The attachments are usual spam mail. I get those mails on two computers, but now you mentioned it... It is possible I get them a lot more when I'm using one of them, so maybe there really is some kind of virus on it... I'll check. Thanks guys!
*




you should also enable email headers and find the actual origin of the email. you can trace it back to the specific IP address of origin and it would be interesting if it was identical for every message. then you would know for sure if it originated from you or if it originated from some other source... plus, you can then report the person to your internet provider to eliminate the mail you are getting... here is a good email tracing article:

hxxp://scissec.scis.ecu.edu.au/publications/forensics04/Al-Zarouni.pdf

good luck

-exp0sed
lostsoul
it could be possible that someone who you have sent an email to or has you in their address book has gotten a virus and its sending out mail and forging the adddress as yours.
crock
It could be just spammers checking if your e-mail address exists.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2005 Invision Power Services, Inc.