Live Chat & Podcast at 1:00PM Eastern on Sunday!
There's no such thing as a stupid question, but they're the easiest to answer.
JoinTour
Login
Search
Web & Email
Tag Cloud
access acer asus bios bsod computer crash desktop driver drivers error ethernet excel freeze gaming hard drive hardware hdmi internet laptop malware memory modem monitor motherboard network printer problem ram registry router security slow software sound toshiba trojan ubuntu 11.10 uninstall usb video virus vista wifi windows windows 7 windows 7 32 bit windows 7 64 bit windows xp wireless
Search
Search for:
Tech Support Guy Forums > Internet & Networking > Web & Email >
Solved: Exchange User's Email Address Being Used Maliciously?

Reply  
Thread Tools
d33psky's Avatar
Junior Member with 10 posts.
 
Join Date: Mar 2009
Experience: Advanced
18-Nov-2009, 11:22 AM #1
Solved: Exchange User's Email Address Being Used Maliciously?
One of my Exchange 2003 users is getting "Undelivered Mail Returned to Sender" emails from emails that she never sent. Is there a way to track/and or prevent this from happening?

Here is the header, my user is hnabers.

Code:
Received: from vtjzixvpm1.ventech.com (ZixVPM [127.0.0.1])
    by Outbound.ventech.com (Proprietary) with ESMTP id 9A35F4C18A
    for <newsletter@ticketsnow.com>; Wed, 18 Nov 2009 06:50:27 -0600 (CST)
Received: from jbsrexch01.j*******.com (uslec-63-243-115-166.cust.uslec.net [63.243.115.166])
    by vtjzixvpm1.ventech.com (Proprietary) with ESMTP id DC9823F481C
    for <newsletter@ticketsnow.com>; Wed, 18 Nov 2009 06:50:26 -0600 (CST)
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----_=_NextPart_001_01CA684D.B2A42D09"
X-MimeOLE: Produced By Microsoft Exchange V6.5
Subject: Out of Office AutoReply: Ticket Alert Heather . Lady Gaga goes solo starting this November!
Date: Wed, 18 Nov 2009 07:50:25 -0500
Message-ID: <2D4C6573E8E30E44A4130DE11638206CEA2264@jbsrexch01.jaxbank.com>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: Ticket Alert Heather . Lady Gaga goes solo starting this November!
Thread-Index: AcpoTbKJ0Ial8kPtRxupRRgxE1EOBQAAAAbm
From: "Nabers, Heather" <hnabers@*******.com>
To: "TicketsNow" <newsletter@ticketsnow.com>
Any idea whats going on here?

Last edited by d33psky; 18-Nov-2009 at 02:50 PM..
cwwozniak's Avatar
Computer Specs
Trusted Advisor with 32,994 posts.
 
Join Date: Nov 2005
Location: McHenry, IL - USA
Experience: Enough to be dangerous
18-Nov-2009, 02:45 PM #2
It is most likely that spammers got a hold of the person's e-mail address one way or another. They troll web sites, including this one, looking for e-mail addresses (like the one in your post) to add to their collection. They are then using that address as the sender address in the header to send spam to others.
__________________
Chuck W.
I am not in this world to live up to your expectations, And you are not in this world to live up to mine. - Fritz Perls
d33psky's Avatar
Junior Member with 10 posts.
 
Join Date: Mar 2009
Experience: Advanced
18-Nov-2009, 02:49 PM #3
Thanks for your reply. That's basically what I've told my users in the past. I suppose I should remove the full email address from this thread.

So basically it is out of my hands at this point?
cwwozniak's Avatar
Computer Specs
Trusted Advisor with 32,994 posts.
 
Join Date: Nov 2005
Location: McHenry, IL - USA
Experience: Enough to be dangerous
18-Nov-2009, 04:01 PM #4
Quote:
Originally Posted by d33psky View Post
So basically it is out of my hands at this point?
Unfortunately that is the case. If you try to filter out the bounce messages for the spam with the forged headers, you would also probably filter out any real bounce messages.
d33psky's Avatar
Junior Member with 10 posts.
 
Join Date: Mar 2009
Experience: Advanced
18-Nov-2009, 04:04 PM #5
Yeah, that's a good point. My user's just going to have to deal with it, haha. Thanks for your help.
Reply

THIS THREAD HAS EXPIRED.
Are you having the same problem? We have volunteers ready to answer your question, but first you'll have to join for free. Need help getting started? Check out our Welcome Guide.

Search Tech Support Guy

Find the solution to your
computer problem!




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
WELCOME TO TECH SUPPORT GUY! Are you looking for the solution to your computer problem? Join our site today to ask your question -- for free! Our site is run completely by volunteers who want to help you solve your computer problems. See our Welcome Guide to get started.
Thread Tools



Facebook Facebook Twitter Twitter TechGuy.tv TechGuy.tv Mobile TSG Mobile
You Are Using:
Server ID
Advertisements do not imply our endorsement of that product or service.
All times are GMT -4. The time now is 11:22 PM.
Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved.

Powered by Cermak Technologies, Inc.