Discussion:
Has my computer been hijacked by a spammer?
(too old to reply)
Gerry
2005-01-12 22:47:01 UTC
Permalink
I am receiving email messages like this:

"This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

"
and the following address is not one that I recognise.

I wonder whether my computer has been hijacked by a computer for sending out
spam. I am using Norton anti-virus software and I hope that may protect me
from having my computer taken over by spammers.

Any advice will be very welcome.

Gerry
nicksantos
2005-01-19 01:18:15 UTC
Permalink
Norton is very good so I doubt it is a virus.
What is most likely is that a smapper is using you identity (Email
address)
Email is like US mail. Spammers can put anything
they want in the "From:" line. This crook has used your email address and
sending it out to millions of addresses and what you get is the "bounce"
back when those addresses fail.
I had the same thing happen to me by a moron from Brazil:
informacoesonline.com aka maisrenda

Not much you can do except when the complete email message is returned.
If the complete message is returned you can use

http://www.spamcop.net

If you get a complete email back you can sign
Spamcop is a free service and it is GREAT!!!
nicksantos
2005-01-22 20:22:25 UTC
Permalink
Stupid mornon from brazil is using my domain name to spoof spamassassin
filters but I submitted all the domains he owns to the .org site so that
ALL these domains get filtered:

ES
www.rendacar.com www.aumentesuarenda.net www.avisligh.com
www.sucessovip.com www.informacoesonline.com
www.festinhasuniversitarias.com www.maisrenda.com www.bixkla4.info
www.lmnc84s.info www.radewq54sd.info www.wqeryty.info www.jfdsioe.info
www.abscissae.com www.nrknvt.info www.vendasvip.com www.colinread.com
www.vipfilmes.com www.glsfilmes.com www.festinhasbrasil.com
www.videosgls.com www.sexofilmes.com www.webgatas.com
www.informacoesonline.com www.maioresinformacoes.com www.business-br.com

Example:
SPAM: -------------------- Start SpamAssassin results
----------------------
SPAM: This mail is probably spam. The original message has been altered
SPAM: so you can recognise or block similar unwanted mail in future.
SPAM: See http://spamassassin.org/tag/ for more details.
SPAM:
SPAM: Content analysis details: (22.30 hits, 5 required)
SPAM: FROM_HAS_MIXED_NUMS (-0.9 points) From: contains numbers mixed in
with letters
SPAM: NO_REAL_NAME (-0.3 points) From: does not include a real name
SPAM: UNDISC_RECIPS (2.0 points) Valid-looking To
"undisclosed-recipients"
SPAM: MSGID_HAS_NO_AT (1.7 points) Message-Id has no @ sign
SPAM: INVALID_DATE (1.6 points) Invalid Date: header (not RFC
2822)
SPAM: INVALID_MSGID (1.2 points) Message-Id is not valid, according
to RFC 2822
SPAM: ALL_CAPS_HEADER (1.1 points) Header with all capitals found
SPAM: SMTPD_IN_RCVD (0.9 points) Received via SMTPD32 server
(SMTPD32-n.n)
SPAM: CALL_FREE (-0.7 points) BODY: Contains a tollfree number
SPAM: HOME_EMPLOYMENT (2.9 points) BODY: Information on how to work at
home (2)
SPAM: ONCE_IN_LIFETIME (2.1 points) BODY: Once in a lifetime,
apparently
SPAM: REMOVE_SUBJ (1.7 points) BODY: List removal information
SPAM: DRASTIC_REDUCED (1.0 points) BODY: Drastically Reduced
SPAM: SPAM_PHRASE_21_34 (3.6 points) BODY: Spam phrases score is 21 to
34 (high)
SPAM: [score: 22]
SPAM: LINES_OF_YELLING (0.3 points) BODY: A WHOLE LINE OF YELLING
DETECTED
SPAM: DATE_IN_PAST_24_48 (2.7 points) Date: is 24 to 48 hours before
Received: date
SPAM: RCVD_IN_OSIRUSOFT_COM (0.4 points) RBL: Received via a relay in
relays.osirusoft.com
SPAM: [RBL check: found
142.249.10.63.relays.osirusoft.com., type: 127.0.0.3]
SPAM: X_OSIRU_DUL (0.6 points) RBL: DNSBL: sender ip address in in
a dialup block
SPAM: X_OSIRU_DUL_FH (0.4 points) RBL: Received from first hop dialup
listed in relays.osirusoft.com
SPAM: [RBL check: found
142.249.10.63.relays.osirusoft.com., type: 127.0.0.3]
SPAM:
SPAM: -------------------- End of SpamAssassin results
---------------------

Loading...