OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: (Maybe OT) Speaking of Backscatter...

From: Terry Carmen (terrycnysupport.com)
Date: Tue Apr 22 2008 - 11:05:02 CDT

Leo Ofenstein wrote:
> First, I apologize if you are offended at a question not related
> directly and absolutely to postfix (at least, it probably doesn't
> relate... it may, but I don't know what software the County's email
> server uses - it could be postfix for all I know ;>), but this group
> has the best and brightest email minds that I have seen, and I am
> hoping you can help!
>
> My neighbor, a County Judge, has begun receiving 100s of bounce
> notices a day. It appears that someone forged her return address on a
> spam campaign, because it doesn't look like the messages actually came
> from malware on her computer. This same thing happens to me every once
> in a while, but it seems to last only a day or two... I have a
> suspicion it may be very prevalent. I have two questions about this.
>
> First, what is the best way to be sure that the messages don't
> originate from her computer? I checked it with Kaspersky, AVG and
> HiJack (it's a Win XP Pro box) and see no infections, and the headers
> of the bounced messages don't contain references to her email server,
> but...
>
> Second, other than the annoyance of these blasted messages bouncing
> back, is there a potential blacklisting problem relating to her email
> address?
>
> Thanks for any help you can offer.

There is very little that can be done without access to the mail server.

The best thing to do would be to have her contact the county's Office
Technology/Email department/vendor and tell them what's happening.

Various local filtering options can be used on her PC, however they're
all band-aids. The problem needs to be addressed on her mail server.

It is possible that her PC is infected, but it's more likely that she
just annoyed someone. See http://en.wikipedia.org/wiki/Joe_job

Terry

--

Terry Carmen
CNY Support, LLC
Web. Database. Business.

315.382.3939
http://cnysupport.com
terrycnysupport.com