Outlook Express Privacy Vulnerability Detected

[Abu]

4 days ago I set up Outlook express (part of winXPpro) to
receive my work (university) email. Today I've received 3
spam emails to this account on the same subject (on pain
relieve medication, but I guess body parts enlargement
offers will follow ( ...
Since the time this email acount was estubleshed (1.5
years ago) I never, NEVER used ANY email handling
programs, but accessed the account through the web ONLY.
For all this time I HAVE NOT RECEIVED ONE SINGLE SPAM
MESSAGE to this account, but today. I did not EVER
entered my work email address ANYWHERE, which means I
just got it stolen (with Outlook Express being
enabling "bridge" for this ) and which means I have a
spyware on my computer that stole it. The spyware I have
must be the "new and unknown" one because it was not
detected/removed by neither of the following programs
(all updated): SpyBot S&D, SpywareBlaster, Ad-Aware 6.0
and (today downloaded scanner) SpyHunter v 1.1.29.

I believe I have a VERY strong case here, which
might/should be of interest to both, Outlook Express AND
AntiSpam software developers.

 

[Abu]

Thanks Tony,

You could be right and I am not insisting. I thought I
would let those potentially interested to have a look at
my computer ( I ask nothing in return).
What made me believe that Outlook/spyware are to blame,
was this strikingly PERFECT TIMING of the "events"
(setting up Outlook Express and 3 days later getting the
very first spam messages after 1.5 years of 100% spam-
free life of the account). I do not heavily use that
account (and I had no change in pattern of its usage), I
don't have it in my personal email's (outlook 2000)
address book and those (very few) who have it, have it
for a long time. I never sent messages from this account
to any major email providers (AOL, MSFT, yahoo). I did
sent trial messages to myself at yahoo (just to check),
but as I said I don't have that work email address
entered into ANY of my addressbooks. If this trial
sending was the problem, it makes things even worse,
because it would mean the email address info was
somehow "intercepted"...

 

[Anthony Ewell]

4 days ago I set up Outlook express (part of winXPpro) to
receive my work (university) email. Today I've received 3
spam emails to this account on the same subject (on pain
relieve medication, but I guess body parts enlargement
offers will follow ( ...
Since the time this email acount was estubleshed (1.5
years ago) I never, NEVER used ANY email handling
programs, but accessed the account through the web ONLY.
For all this time I HAVE NOT RECEIVED ONE SINGLE SPAM
MESSAGE to this account, but today. I did not EVER
entered my work email address ANYWHERE, which means I
just got it stolen (with Outlook Express being
enabling "bridge" for this ) and which means I have a
spyware on my computer that stole it. The spyware I have
must be the "new and unknown" one because it was not
detected/removed by neither of the following programs
(all updated): SpyBot S&D, SpywareBlaster, Ad-Aware 6.0
and (today downloaded scanner) SpyHunter v 1.1.29.

I believe I have a VERY strong case here, which
might/should be of interest to both, Outlook Express AND
AntiSpam software developers.

Hi Abu,

Don't jump to conclusions about Outlook express. You could
have been picked up from a entry in a friends address book.
Spammers love to break into other peoples machines to help
hide their identity.

Speaking of security. Outlook is security swiss cheese.
If security is an issue, consider a security hardened eMail
client, such as Mozilla Thunderbird (http://mozilla.org).
It will not autoexecute viruses or execute attachments from
the body of messages, like OE. It also comes with
a trainable Junk filter.

If you don't want to go through the hassle of Junk filters,
then consider changing your eMail address. But, don't send
your new address out to all your friends. It could be one of
them that accidentally got you on the spammers list.

HTH,
--Tony