Printable View
A colleague at work mentioned that he got one of those mail administrator returned mail emails about an email that he never sent. I told him to just change his account password, although he's convinced there's actually a hacker trying to use his email account. Is there any basis to his fears and does he need to wipe his entire system and start again with the same account password as he seems to think? What should I suggest he do?
It is proppably a spoofed email that got sent back..
It works like this..
LAMER: has a virus, the virus sends mail to CORP faking the from adress to JOHNs email adress.
CORP: receives mail, sees it as a virus and sends a notification to JOHN
JOHN: receives mail from CORP and gets mad.. I didn't send that..
Now who's fault is it ??
LAMERs fault for getting infected with a virus (and his ISP for letting him send the mails)
CORPs fault for sending one of those notifications..
more on this here: http://attrition.org/security/rant/av-spammers.html
JinX is probably spot on.
He's maybe a bit harsh calling your collegue a lamer but this is the sort of thing you hear about 5 times a day especially if you work on the helldesk.
I didn't call his colegue a lamer.. I called his colegue JOHN..
Luckily I don't do helldesks (anymore)..
wheaty_bytes, it might be nice if you could paste the contents of the mail..
That might point out who is to blame ;)
It is possible.Quote:
A colleague at work mentioned that he got one of those mail administrator returned mail emails about an email that he never sent. I told him to just change his account password, although he's convinced there's actually a hacker trying to use his email account.
He could be right on the money. At work we had the same exact issue and the "IT Tech" told the guy just to change his password sad to say the next day it happened again. I would recommend just creating a new email address for him.Quote:
Is there any basis to his fears and does he need to wipe his entire system and start again with the same account password as he seems to think? What should I suggest he do?
Post the email headers.
I wouldn't. It's a lot of work to do (informing everyone etc.).Quote:
Originally posted here by Computernerd22
I would recommend just creating a new email address for him.
Is there any other evidence the account has been compromised? This problem on it's own does not indicate a compromised account.
Just ignore it. Eventually the person with the virus will get sorted out.
Steve
I wouldn't just ignore it. All this will do is piss off the guy who clearly thinksQuote:
Just ignore it. Eventually the person with the virus will get sorted out.
And the IT Tech is just "ignoring the issue," Kill two birds with one stone. Get rid of the lamer who is using his email account and second, make the worker happy by changing his email address to something he likes that way it (makes it look like you did something for him) and should easily resolve the other issue he was having. :) If worse comes to worse can't you just delete that specific email address that has been so called hacked, and create a new one? I think this would be better thanQuote:
he's convinced there's actually a hacker trying to use his email account.
If you were going to reformat the harddrive resinstall windows go back on and use the same account information that would be pointless to do.Quote:
need to wipe his entire system and start again with the same account password as he seems to think?
the_JinX: right enough, Doh!
wheaty_bytes: was it a personal email account or was it a work account?
Without other supporting evidence this is the correct thing to do. It is a waste of resource to create new accounts like this.Quote:
Crikey, if the support guys here started doing this, they'd get nothing else done.
The guy may be convinced he's being hacked, this doesn't make it true.
I'm convinced I'm god's gift to women...
Steve
There are numerous mallware that spoof the from email address.....
Mostly we ignore it...but I do check the machine or account....change passwords etc
I also try and get a copy of the email or headers...to determine where its coming from.
We have it happen here...shows internal user is sending internal email virus to other users.....looking at the header...shows its coming from outside...the local cable smtp server..........which is not the ISP we use.............spoofed.
MLF
Well,
It would not do any harm to do a full safe mode scan for malware?
There have been some nasties of late that fake a returned e-mail as their vector. User sees this and opens it...........................oooooooooops!
just a thought :)
Since most of these virii grab addresses from the address book, getting a new email account won't really do anything. As soon as he lets all of his collegues know his knew address and they add him to their address books again, his knew address will most likely be spoofed. I agree with Milner that this is more or less to be bulked with spam and ignored unless there is a real compromise.