getting 100's of Undeliverable messages a day

33boston · 12-29-2005, 02:13 PM

Hi, I just recently started getting 100's of emails a day from "System Administrator" stating that the message (which I never sent) is Undeliverable.
It then lists a bunch of email addresss that I've never seen! Is this a virus? Here's an example:

Your message did not reach some or all of the intended recipients.

Subject: re: mortgage application
Sent: 12/29/2005 2:04 PM

The following recipient(s) could not be reached:

rounder panafonet.gr on 12/29/2005 3:04 PM
The message could not be delivered because the recipient's mailbox is full.
<hamail . panafonet.gr (ims-ms-daemon) #5.2.2>

sad panafonet.gr on 12/29/2005 3:04 PM
The message could not be delivered because the recipient's mailbox is full.
<hamail . panafonet.gr (ims-ms-daemon) #5.2.2>

sandy panafonet.gr on 12/29/2005 3:04 PM
The message could not be delivered because the recipient's mailbox is full.
<hamai panafonet.gr (ims-ms-daemon) #5.2.2>

simons panafonet.gr on 12/29/2005 3:04 PM
The message could not be delivered because the recipient's mailbox is full.
<hamail panafonet.gr (ims-ms-daemon) #5.2.2>

slalom panafonet.gr on 12/29/2005 3:04 PM
The message could not be delivered because the recipient's mailbox is full.
<hamail panafonet.gr (ims-ms-daemon) #5.2.2>

sophi panafonet.gr on 12/29/2005 3:04 PM
The message could not be delivered because the recipient's mailbox is full.
<hamail panafonet.gr (ims-ms-daemon) #5.2.2>

spits panafonet.gr on 12/29/2005 3:04 PM
The message could not be delivered because the recipient's mailbox is full.
<hamail panafonet.gr (ims-ms-daemon) #5.2.2>

strata panafonet.gr on 12/29/2005 3:04 PM
The message could not be delivered because the recipient's mailbox is full.
<hamail panafonet.gr (ims-ms-daemon) #5.2.2>

CbrMas1 · 12-30-2005, 08:09 AM

it could be a virus, or it could be your internet connection. Did you try a virus scan?

33boston · 12-30-2005, 09:51 AM

I think I'm all set. I have Microsoft Antispyware and when I ran a deep scan it found a Trojan virus. I had to run a Restore with XP and so far today I haven't recieved anything. I was getting these through my work email which threw me off. I ran the spyware at home and that's where I found it. Thanks!

33boston · 01-03-2006, 07:44 AM

I thought I was all set but it seems to be happening again! Any ideas? The email is through work but I use it at home also. It doesn't seem to be affecting anyone else at work so should I be concentrating more on my home PC? Thanks

aprior · 01-10-2006, 08:15 PM

It could be many things. I would wager that the mailbox name part of your email address (the part before the @) is a fairly common or simple english name like 'Joe' or 'Bob'.
-Your work email server could be an open relay that spammers are using to send out spam using your email address as the From: address
-Someone else in your company could have an infected computer that is sending email using your email address as the From address

Once they have a domain name (such as yourworkdomain.com), spammers and viruses will try to send mail using many common names as the From address.

In any of these cases, the best person to talk to would be your email server administrator. If you do get ahold of them, recommend SPF to them.

Everyone tell your friends about SPF... the more that use it, the merrier :)

batty_professor · 01-10-2006, 08:43 PM

I wouldn't want my email address posted in a web forum as those in your first post. Although since those mailboxes are reported as full, I would say the damage has already been done, I will edit those out shortly. Your home computer may have an infection, and I would encourage you to get help from our security team here. and post a logfile.
The report you received should contain an originating IP address of the spam email. You should check to see if it matches that of your home or work computer. To see your own broadcasted IP address, you can hover your mouse pointer over the "little computer" under your name on any of your posts on this forum.

Michael Roder · 02-18-2006, 03:30 PM

This happened to one of my email accounts not too long ago. In working with the ISP, we concluded a spammer was spoofing my email address. Since many of his guesses for valid email addresses are wrong the message came back to me. Net result is there is nothing you can do--the bad guy won again. I disabled the account rather than deleting it since I might want to use it in the future.

12-29-2005, 02:13 PM	#1 (permalink)
33boston Registered User Join Date: Sep 2005 Posts: 16 OS: xp	getting 100's of Undeliverable messages a day Hi, I just recently started getting 100's of emails a day from "System Administrator" stating that the message (which I never sent) is Undeliverable. It then lists a bunch of email addresss that I've never seen! Is this a virus? Here's an example: Your message did not reach some or all of the intended recipients. Subject: re: mortgage application Sent: 12/29/2005 2:04 PM The following recipient(s) could not be reached: rounder panafonet.gr on 12/29/2005 3:04 PM The message could not be delivered because the recipient's mailbox is full. <hamail . panafonet.gr (ims-ms-daemon) #5.2.2> sad panafonet.gr on 12/29/2005 3:04 PM The message could not be delivered because the recipient's mailbox is full. <hamail . panafonet.gr (ims-ms-daemon) #5.2.2> sandy panafonet.gr on 12/29/2005 3:04 PM The message could not be delivered because the recipient's mailbox is full. <hamai panafonet.gr (ims-ms-daemon) #5.2.2> simons panafonet.gr on 12/29/2005 3:04 PM The message could not be delivered because the recipient's mailbox is full. <hamail panafonet.gr (ims-ms-daemon) #5.2.2> slalom panafonet.gr on 12/29/2005 3:04 PM The message could not be delivered because the recipient's mailbox is full. <hamail panafonet.gr (ims-ms-daemon) #5.2.2> sophi panafonet.gr on 12/29/2005 3:04 PM The message could not be delivered because the recipient's mailbox is full. <hamail panafonet.gr (ims-ms-daemon) #5.2.2> spits panafonet.gr on 12/29/2005 3:04 PM The message could not be delivered because the recipient's mailbox is full. <hamail panafonet.gr (ims-ms-daemon) #5.2.2> strata panafonet.gr on 12/29/2005 3:04 PM The message could not be delivered because the recipient's mailbox is full. <hamail panafonet.gr (ims-ms-daemon) #5.2.2> Last edited by batty_professor; 01-10-2006 at 08:47 PM. Reason: kill live email links

01-10-2006, 08:43 PM	#6 (permalink)
batty_professor Asst. Manager, Alternative Computing Forums Join Date: Jul 2004 Location: Hooterville Il 45 mi. east of St. Louis mo Posts: 2,608 OS: Fedora Core 5 for now	I wouldn't want my email address posted in a web forum as those in your first post. Although since those mailboxes are reported as full, I would say the damage has already been done, I will edit those out shortly. Your home computer may have an infection, and I would encourage you to get help from our security team here. and post a logfile. The report you received should contain an originating IP address of the spam email. You should check to see if it matches that of your home or work computer. To see your own broadcasted IP address, you can hover your mouse pointer over the "little computer" under your name on any of your posts on this forum. __________________ It's better to know me and not need me than to need me and not know me. B. While users are never under any obligation, if you feel the urge please feel free to visit our donation page. Every little bit helps. And we thank you for your support. Microsoft free Registered Linux user 397458

02-18-2006, 03:30 PM	#7 (permalink)
Michael Roder Registered User Join Date: Nov 2004 Posts: 2 OS: WinXP	Undeliverable email messages This happened to one of my email accounts not too long ago. In working with the ISP, we concluded a spammer was spoofing my email address. Since many of his guesses for valid email addresses are wrong the message came back to me. Net result is there is nothing you can do--the bad guy won again. I disabled the account rather than deleting it since I might want to use it in the future.

12-30-2005, 08:09 AM	#2 (permalink)
CbrMas1 Registered User Join Date: Dec 2005 Location: United States of America Posts: 24 OS: Windows XP SP2	it could be a virus, or it could be your internet connection. Did you try a virus scan?

12-30-2005, 09:51 AM	#3 (permalink)
33boston Registered User Join Date: Sep 2005 Posts: 16 OS: xp	I think I'm all set. I have Microsoft Antispyware and when I ran a deep scan it found a Trojan virus. I had to run a Restore with XP and so far today I haven't recieved anything. I was getting these through my work email which threw me off. I ran the spyware at home and that's where I found it. Thanks!

01-03-2006, 07:44 AM	#4 (permalink)
33boston Registered User Join Date: Sep 2005 Posts: 16 OS: xp	I thought I was all set but it seems to be happening again! Any ideas? The email is through work but I use it at home also. It doesn't seem to be affecting anyone else at work so should I be concentrating more on my home PC? Thanks

01-10-2006, 08:15 PM	#5 (permalink)
aprior Registered User Join Date: Jan 2006 Posts: 75 OS: Windows XP Professional, Windows 2000 Professional, Windows 2000 Server	It could be many things. I would wager that the mailbox name part of your email address (the part before the @) is a fairly common or simple english name like 'Joe' or 'Bob'. -Your work email server could be an open relay that spammers are using to send out spam using your email address as the From: address -Someone else in your company could have an infected computer that is sending email using your email address as the From address Once they have a domain name (such as yourworkdomain.com), spammers and viruses will try to send mail using many common names as the From address. In any of these cases, the best person to talk to would be your email server administrator. If you do get ahold of them, recommend SPF to them. Everyone tell your friends about SPF... the more that use it, the merrier :)