[Help] outlook problem

[testing1234]

Hi guys..not sure what causes this but i am sure this is a virus problem but the thing is i have not opened any strange emails nor visit any of those funny website

what i did was i used AVG and norton to scan and some threats were removed. i also changed my password but to no avail

we have outsourced our IT to another IT firm but i have given up on them as you know, the "talents" who helped was just incompetent.

anyone can shed some light on this? appreciate this. thanks

 

[xkiller213]

There might be other infected machines in your network?

 

[testing1234]

dont think so. my colleagues' terminals are all fine

 

[xkiller213]

I see that you're still running win xp and office 2003... Did you keep them updated? Microsoft Update

Anyway, this seems to be the wrong place to post this qn.. Haha..

 

[testing1234]

I see that you're still running win xp and office 2003... Did you keep them updated? Microsoft Update

Anyway, this seems to be the wrong place to post this qn.. Haha..

yea i keep my pc updated. strange and frustrating problem!

oops..my bad

 

[Supersen]

one of my colleague also knna now...

contacted my email vendor

waiting to be resolved, anyone know if it is the symptoms of the email server infected?

the web mail also got alot of this spams...

 

[peterchan75]

Select Tools > Rules & Alerts > New Rules

Create a rule that match the subject title and move these junk mail to Deleted Items. This should at least unclog your inbox.

 

[xkiller213]

Actually, if your email provider has a web mail interface, change your password and use it for a while, and check if the undelivered messages still appear.. Do not change the password in outlook (let it get authentication failed)...

 

[testing1234]

one of my colleague also knna now...

contacted my email vendor

waiting to be resolved, anyone know if it is the symptoms of the email server infected?

the web mail also got alot of this spams...

not too sure bout that...all i know is its slowing me down from my work and very frustrating!! lol

 

[xkiller213]

not too sure bout that...all i know is its slowing me down from my work and very frustrating!! lol

If the only thing which you're having a problem with is the inbox clutter, then yes, do as what peterchan said, create a filter...

But before that, I would advice you to get your computer checked.. If possible, plug your hdd into a computer which is known not to be infected and do a complete scan of your hdd.. Who knows what viruses might be found...

Also, make sure Microsoft update is installed (Microsoft update is different from Windows update, you need to opt in to MS update and install a plugin before you can use it)...

 

[testing1234]

right..thanks guys!!

 

[Override2Zion]

...If possible, plug your hdd into a computer which is known not to be infected and do a complete scan of your hdd.. Who knows what viruses might be found...

This is a good suggestion, IMHO. If the virus gets an opportunity to run, it does all sorts of tricks to disguise itself. Best case scenario if it is a virus, but if its something more malicious (DDOS) then you'd have to handle it carefully.

Email return address can be spoofed easily. Sending out emails to an invalid address with your spoofed address will cause the undeliverable messages (NDN/NDR) to return to you. This becomes a form of DOS/DDOS when done in mass quantities.

More information for NDR DDOS Attacks via the link below,
http://www.techzoom.net/publications/mail-non-delivery-attack/

 

[xkiller213]

This is a good suggestion, IMHO. If the virus gets an opportunity to run, it does all sorts of tricks to disguise itself. Best case scenario if it is a virus, but if its something more malicious (DDOS) then you'd have to handle it carefully.

Email return address can be spoofed easily. Send out emails to an invalid address with your spoofed address will cause the undeliverable messages (NDR) to return to you.

That's why it's important to see who the invalid addresses are... If they came from the user's address book, then it might just be because of an infection in their computer...

 

[86technie]

Two areas u can look at:
1) Create a rule as what other said
2) Send a complain to your IT department and ask them
why you keep receiving junk email. Is it the junk email
filter on sever not working or not installed?

 

[testing1234]

That's why it's important to see who the invalid addresses are... If they came from the user's address book, then it might just be because of an infection in their computer...

nope...i checked and so far none are from my address book AFAIK. there are just random email addresses to yahoo mail and all...

Two areas u can look at:
1) Create a rule as what other said
2) Send a complain to your IT department and ask them
why you keep receiving junk email. Is it the junk email
filter on sever not working or not installed?

i did no. 1)

2) the IT team we outsourced is just

kept insisting that it is spam mail and told me to ignore and delete.

 

[Override2Zion]

nope...i checked and so far none are from my address book AFAIK. there are just random email addresses to yahoo mail and all...

How many other users are receiving similar spam? Are your corporate email addresses posted anywhere in the public domain?

 

[testing1234]

How many other users are receiving similar spam? Are your corporate email addresses posted anywhere in the public domain?

how many users meaning my colleagues? none..just me

yes, but so far its only my superior's address is posted up on our own portal. thats bout it.

over the weekends, i can have 1000+ undelivered mails in my outlook

 

[Override2Zion]

over the weekends, i can have 1000+ undelivered mails in my outlook

That weekend was your PC off? If its on, its inconclusive if your PC is infected. However if its off, the attack would be originating from somewhere else. The interval of the NDRs in your inbox seems quite suspicious, several within a minute.

If you're the only one affected in your company, it could be a spammer on the internet choosing your email address to spoof while sending out spam. The targets of the spam are collections of addresses they've found on the internet. Some of these addresses collected may now be invalid and thus resulting in NDRs returning to you.

What is the content included within the NDR message? Are there any website links or attachments included? These can be signs to help narrow down the objective/intent of the spam.

 

[testing1234]

That weekend was your PC off? If its on, its inconclusive if your PC is infected. However if its off, the attack would be originating from somewhere else. The interval of the NDRs in your inbox seems quite suspicious, several within a minute.

If you're the only one affected in your company, it could be a spammer on the internet choosing your email address to spoof while sending out spam. The targets of the spam are collections of addresses they've found on the internet. Some of these addresses collected may now be invalid and thus resulting in NDRs returning to you.

What is the content included within the NDR message? Are there any website links or attachments included? These can be signs to help narrow down the objective/intent of the spam.

apologies...but whats NDR?

it was on standby but even when my pc is off for the day, those undelivered mail starts flooding my inbox as soon as i launch my outlook

btw i forwarded this email to the external IT team

 

[Override2Zion]

No worries, sorry for the jargon. NDR stands for Non-Delivery Report.

From your description,
1) You've already changed the password (best to be done using another phone/tablet/mac that is confirmed "clean", not all but most viruses are platform/exploit dependent)
2) Returned mail topic "MY DEAR YOUR COMPENSATION FUNDS PAYMENT ORDER VIA ATM CARD"
3) NDRs continue to flood inbox despite PC being off
4) The timestamp of the NDRs received falls within the duration when your PC is off

If all terminals you use to access corporate mail either at home or office is clean then all the points above suggest that scammers are spoofing your email to send out spams. Your email account is likely to be still safe and uncompromised. For the spamming, there is nothing much you can do though but to besides filtering on your end.

Can also try scanning using MBAM, its free
http://www.malwarebytes.org/products/malwarebytes_free/