Somebody is spoofing

I recently received five email rejects from AOL that seem to have originated
from my system and OE at first glance.
However, the versions for OE and OLE do not match my systems. The addressees
are not in any address book on my system. There are (according to current
virus scanners and some other email related utilities) no applications or
trojans on my system that can cause such a thing.

What is even more interesting is that I currently do not normally send mail
via MSN, due to my cable IP's port blocking.
(A very small number of messages were sent out thru the MSN hotmail
selection during a recent pop3/passport outage earlier in the week. )
The cable IP mail server does not appear in the header information.
It looks like someone sent stuff to AOL users, spoofed my address and the
MSN mail server.

Is anyone else having this sort of problem? Or, is this (I hope) an isolated
incident.

Colin
Fri Aug 01 16:07:24 CDT 2003

As an example, today I received an undeliverable response for a message I
didn't send. It's not the first.

"Mike M" <No_Spam@Corned_Beef.Only> wrote in message
news:OI4%23j9GWDHA.1620@TK2MSFTNGP12.phx.gbl...
> Many viruses spoof the senders address, either by stealing one from the
> infected user's address book or often by creating one by combining two
> distinct addresses to make a third taking the first part from one address
and
> the domain from another.
>
> So no this isn't an isolated incident but rather has been happening for
years.
> --
> Mike Maltby MS-MVP
> mcmaltby@hotmail.com
>
>
> C.D.Kuder <cdkuder@email.msn.com> wrote:
>
> > I recently received five email rejects from AOL that seem to have
> > originated from my system and OE at first glance.
> > However, the versions for OE and OLE do not match my systems. The
> > addressees are not in any address book on my system. There are
(according
> > to current virus scanners and some other email related utilities) no
> > applications or trojans on my system that can cause such a thing.
> >
> > What is even more interesting is that I currently do not normally send
> > mail via MSN, due to my cable IP's port blocking.
> > (A very small number of messages were sent out thru the MSN hotmail
> > selection during a recent pop3/passport outage earlier in the week. )
> > The cable IP mail server does not appear in the header information.
> > It looks like someone sent stuff to AOL users, spoofed my address and
the
> > MSN mail server.
> >
> > Is anyone else having this sort of problem? Or, is this (I hope) an
> > isolated incident.
>
>

Dave
Fri Aug 01 19:44:20 CDT 2003

On Fri, 01 Aug 2003 21:07:24 GMT,"Colin" <colin@post.com.it> penned this
whopper in news:mFAWa.2641$kv.123959@newsfep2-gui.server.ntli.net:

> As an example, today I received an undeliverable response for a
> message I didn't send. It's not the first.
>
> "Mike M" <No_Spam@Corned_Beef.Only> wrote in message
> news:OI4%23j9GWDHA.1620@TK2MSFTNGP12.phx.gbl...
>> Many viruses spoof the senders address, either by stealing one from
>> the infected user's address book or often by creating one by
>> combining two distinct addresses to make a third taking the first
>> part from one address
> and
>> the domain from another.
>>
>> So no this isn't an isolated incident but rather has been happening
>> for
> years.
>> --
>> Mike Maltby MS-MVP
>> mcmaltby@hotmail.com
>>
>>
>> C.D.Kuder <cdkuder@email.msn.com> wrote:
>>
>> > I recently received five email rejects from AOL that seem to have
>> > originated from my system and OE at first glance.
>> > However, the versions for OE and OLE do not match my systems. The
>> > addressees are not in any address book on my system. There are
> (according
>> > to current virus scanners and some other email related utilities)
>> > no applications or trojans on my system that can cause such a
>> > thing.
>> >
>> > What is even more interesting is that I currently do not normally
>> > send mail via MSN, due to my cable IP's port blocking.
>> > (A very small number of messages were sent out thru the MSN hotmail
>> > selection during a recent pop3/passport outage earlier in the week.
>> > ) The cable IP mail server does not appear in the header
>> > information. It looks like someone sent stuff to AOL users, spoofed
>> > my address and
> the
>> > MSN mail server.
>> >
>> > Is anyone else having this sort of problem? Or, is this (I hope) an
>> > isolated incident.
>>
>>
>
>
>

The spoofed bounce message is actually a recent viral variant of address
spoofing. I think it started last fall.

--
"Belief is not the beginning but the end of all knowledge."
Johann Wolfgang von Goethe (1749-1832); German poet and dramatist.
HAND!
Mike

Mow
Sat Aug 02 01:09:25 CDT 2003

C.D.,

It's not uncommon for "bots" to harvest your email address and send out
virus'. Happened to me last year ... got some nasty emails until I
straightened the whiners out. Some peeps don't know how to view the
source of such scurrilous slimemail ... in fact, mowst don't.

MowGreen
*-343-*
Never Forgotten

C.D.Kuder wrote:

> I recently received five email rejects from AOL that seem to have originated
> from my system and OE at first glance.
> However, the versions for OE and OLE do not match my systems. The addressees
> are not in any address book on my system. There are (according to current
> virus scanners and some other email related utilities) no applications or
> trojans on my system that can cause such a thing.
>
> What is even more interesting is that I currently do not normally send mail
> via MSN, due to my cable IP's port blocking.
> (A very small number of messages were sent out thru the MSN hotmail
> selection during a recent pop3/passport outage earlier in the week. )
> The cable IP mail server does not appear in the header information.
> It looks like someone sent stuff to AOL users, spoofed my address and the
> MSN mail server.
>
> Is anyone else having this sort of problem? Or, is this (I hope) an isolated
> incident.
>
>