Web Hosting Talk : Other Forums : Web Hosting Lounge : someone using my mail?

[moshes]

Hi,

The last day I have been getting mailer demonds back saying that I have emailed people certain spam messages when in fact I have not emailed them and there is no record in my outlook send folder. When I read the path of the mail it seems that it is coming from me???

Any thoughts?

[Informity]

someone setting the from/reply-to address to yours probably...

[MarcD]

Do you own the server are you a shared host on it.

If you own it check your server logs check formail to make sure its secure

if you are a shared host contact your hosting provider.

Have you upgraded cpanel ? There is a flaw in formail awhile back

[moshes]

I am ebarrised to admit I am still on shared, actually more then one shared and I use more mgs then anyone I know on shared stuff.

[MarcD]

Sounds like there is something insecure you said you checked the path already. I would contact your host the responsibility for this lies on them.

[JayC]

Originally posted by moshes
When I read the path of the mail it seems that it is coming from me???

Are you sure? You could post the headers here (mask your own address if you want to) to get that confirmed.

Most likely, as mentioned previously, a bunch of spam was sent out using your address as the from: line. If you get a lot of spam, it's just a matter of time until that happens, since a lot of spammers like to use valid addresses there. But if you're sure about the return path it could be something different and more worrisome.

[chrisranjana]

1. check your computer for viruses.
2. check your computer for worms or trojans or whatever.

[Knogle]

It's probably just someone using your address as the from/return-to address.. But it's definitely better to be safe then sorry.

[shaunewing]

Edit:

Disregard this post... I investigated it further and it was simply my spam filters doing their job and bouncing all mail containing the word "Viagra" (I've yet to receive a legitimate email containing Viagra so it got blocked).

-Shaun

[moshes]

its something like that but I deleted every site of it to see if somehow the messages staying in my outlook were somehow recreating themselves. haven't had for a few hours now

[Zutroy]

Lots of bounce-backs is usually a virus. Very typical of Klez.

[JayC]

Originally posted by Zutroy
Lots of bounce-backs is usually a virus. Very typical of Klez.

Klez finds email addresses on your computer and selects from those both the "from" and "to" values. So a message sent by Klez with your address as the "from" line was quite likely sent from a different infected computer on which your address was found, not from your own computer.

Originally posted by moshes
its something like that but I deleted every site of it to see if somehow the messages staying in my outlook were somehow recreating themselves. haven't had for a few hours now

Even if no more are sent, you'll probably get more bounces after some messages remain undeliverable for a few days. Those messages won't "recreate themselves," so don't worry about that -- post the headers here; examining those is the only way to determine (roughly at least) where the messages are coming from and to possible rule out that they came from your computer.

[Zutroy]

Originally posted by JayC
Klez finds email addresses on your computer and selects from those both the "from" and "to" values. So a message sent by Klez with your address as the "from" line was quite likely sent from a different infected computer on which your address was found, not from your own computer.

Quite correct. I never meant to imply that his computer was infected, just that this is typical of a virus infection. It is often someone elses computer that's infected, pumping out the emails.

[JayC]

Originally posted by Zutroy
It is often someone elses computer that's infected, pumping out the emails.

Yep... but the "from" addresses are selected randomly, just like the "to" addresses. So it'd be unlikely for one Klez-infected computer to send dozens of messages appearing to come from the same address.

At any rate, the content of the messages would make it clear whether it was a Klez virus or something similar, or spam. Moshes referred to them as "spam messages" but it's not clear whether he called them that because of their content or just because there were a lot of them.

[Zutroy]

I'm not 100% certain how Klez works (does it randomize the "from" address for each email, or once per "session" thus allowing it to send out several from the same address). All I know is I've seen it quite often that the "from" address does not change, and dozens, if not hundreds of emails get sent out with the same from address.