We are (unintentionally) sending out spam

[Wayne-I-M]

Hi

I came in this morning to find over 300 auto answers from spam blockers all
over the world saying that the messages we had sent had been blocked by
their spam blockers. We have also had a number of phone calls from our
suppliers to ask that we stop sending them pornographic spam.

We have NEVER sent out a promotional e mail to anyone.

I have looked in the sent messages folder and there is nothing there. I
don’t even know where to start looking - has anyone any ideas.

Thank you.

 

[Judy Gleeson \(MVP Outlook\)]

Start by checking for virus. That's a fairly common things that nasty virus
do. It's highly unlikely to be an Outlook issue.

Call you IT support people asap as you may be infecting other people's
systems as well and that's not good for business!

Regards

Judy Gleeson
MVP Outlook
Trainer and Consultant www.pragmatix.com.au
My suggested settings for Outlook 2003 are FREE on my website.

..

 

[Wayne-I-M]

Hi Judy

Thanks for your quick answer. The strange thing is, is that the people who
we are sending mails to. Most of them are not on our address list - we have
an agency in America and this is only US address we have but we have sent
mails to of 50 people in the USA.

We have an agency in Nepal but we have not mailed them or the office in
France. Very strange. I have run Norton and this has come up with nothing
(mind you does it ever ?)

At the moment we have come up with the only certain answer and pulled the
internet connection out of the back of the main server. (I am sending this
from another laptop on a WiFi from starbucks - which is accross the road so
we can use thier connection).

I am lost with this whole thing. I Think we will just have reformat
everything as this is the only way I can think of the be sure - unless you
have any other suggesitons


--
Wayne
Manchester, England.

Start by checking for virus. That's a fairly common things that nasty virus
do. It's highly unlikely to be an Outlook issue.

Call you IT support people asap as you may be infecting other people's
systems as well and that's not good for business!

Regards

Judy Gleeson
MVP Outlook
Trainer and Consultant www.pragmatix.com.au
My suggested settings for Outlook 2003 are FREE on my website.

..

 

[Judy Gleeson \(MVP Outlook\)]

I think you have done the right thing so far - disconnect from the web!

Get onto your IT support people and have them suggest what else to do.

Regards

Judy Gleeson
MVP Outlook
Trainer and Consultant www.pragmatix.com.au
My suggested settings for Outlook 2003 are FREE on my website.

..

Hi Judy

Thanks for your quick answer. The strange thing is, is that the people
who
we are sending mails to. Most of them are not on our address list - we
have
an agency in America and this is only US address we have but we have sent
mails to of 50 people in the USA.

We have an agency in Nepal but we have not mailed them or the office in
France. Very strange. I have run Norton and this has come up with
nothing
(mind you does it ever ?)

At the moment we have come up with the only certain answer and pulled the
internet connection out of the back of the main server. (I am sending this
from another laptop on a WiFi from starbucks - which is accross the road
so
we can use thier connection).

I am lost with this whole thing. I Think we will just have reformat
everything as this is the only way I can think of the be sure - unless you
have any other suggesitons

 

[Pat Willener]

It is also possible that some spammer has forged your email address to
send out their spewage, and receiving mail servers sent them "back" to
the address in the From header.

If you have a full original message attached in one of the non-delivery
receipts, you can check the originating IP address in the headers to
confirm whether they really came from you, or from somewhere completely
unrelated.

 

[Wayne-I-M]

Thank you for your advice. I have just googled this and come up with the
fact that some spamers send out mails as if they are from us (not a clue how
this is done) so that any spam blockers will send the reject mail to us and
that is what we are getting.

Thanks again for your advice.

 

[Roady [MVP]]

In addition to what has been discussed with Judy.

Who's actually sending this according to the receivers? A single individual
or multiple people from your office site?
You might want to have your admins check the mail server and verify it is
not configured as an open relay server.

 

[Wayne-I-M]

Thank you Pat

I will pass your suggestion on to the IT dept.

 

[Wayne-I-M]

Hi

It appears that Pat's idea was correct. To put it politely there is simply
nothing we can do about it. The IP address are based all over the place and
they have simple put our return address on the headers.

To get round this (for now) we have simply had all the on-line forms send
direct to an access DB that is inbedded on our site and we have contacted
everyone on our mailing list with a new e mail address.

Maybe this is just the world we now live in - there are a lot of con-men on
the web.

Oh well.

--
Wayne
Manchester, England.

 

[Brian Tillman]

It appears that Pat's idea was correct. To put it politely there is
simply nothing we can do about it. The IP address are based all over
the place and they have simple put our return address on the headers.

Is it only one address receiving hte NDRs? If more than one, the question
arises as to how the spammers got access to your internal address list. If
it's just one address, then it would appear that the address either was
published in a public place on the Internet or the PC of someone with that
address in its address book (one of the people who writes to you at that
address) has been subverted to a spam-spewer.

 

[Wayne-I-M]

Hi Brian

I think we have sorted the problem. - It seems the spamers were sending
out mails with our details in the header and that was the reason the blockers
mailed us with jections and last weekend our (hosts) placed all there clients
address links on thier website for some very strange reason. They have now
undone this but the damage was already done. I think we got off lightly -
some people do not have the backup that we do and it will cause them quite a
few problems.