Delivery Status Notification (Failure) Emails

ste-sim2x9 · 17 Dec 2012 at 16:20

Can anyone tell why i could be getting these emails and how to stop them. Last week i checked my mail and was bombarded with 300+ Delivery Status Notification (Failure) and Delivery Status Notification (Delay) emails. I deleted them but the next day i get them again, just don't understand how and why i'm getting these emails.

leigh_boy · 17 Dec 2012 at 16:52

exchange transport error.
scroll to the bottom of the bounce back and it will have an error code. put it up or google it

tom_e · 17 Dec 2012 at 16:53

Someone is probably spoofing your email to send spam and therefore you're getting all the bounced ones.

ste-sim2x9 · 17 Dec 2012 at 16:59

This is the rest of this bounce back, i have 355 of them in my inbox.

FicQ==
Received: by 10.194.179.34 with SMTP id dd2mr7626663wjc.1.1355559902827;
Sat, 15 Dec 2012 00:25:02 -0800 (PST)
Return-Path:
Received: from (know-mailgateway-2.server.virginmedia.net. [62.254.26.101])
by mx.google.com with ESMTPS id p3sm954300wic.8.2012.12.15.00.24.57
(version=SSLv3 cipher=OTHER);
Sat, 15 Dec 2012 00:25:02 -0800 (PST)
Message-ID: <[email protected]>
Received: from source ([103.6.169.29])
by smtp.virginmedia.com with SMTP; Sat, 15 Dec 2012 08:25:01 +0000 (GMT)
X-ProxyUser-IP: 103.6.169.29
Subject: M ;a s$t)u (r^ba "t ^l"n |g
Date: Sat, 15 Dec 2012 08:24:06 +0100
To: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
From: Qqchazv <
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Gm-Message-State: ALoCoQmAAmRCQOGDDeamJp4WS+WHhYltgWWLxqriTEFxQiaZIaV7JlylggyEANw2J/TPwjbAG9x8

debuw http://odnovdw.pisem.su?qsrb gi hoq
qizu fabe zune nucery

opethdisciple · 17 Dec 2012 at 17:03

ste-sim2x9 said:
This is the rest of this bounce back, i have 355 of them in my inbox.

FicQ==
Received: by 10.194.179.34 with SMTP id dd2mr7626663wjc.1.1355559902827;
Sat, 15 Dec 2012 00:25:02 -0800 (PST)
Return-Path: <[email protected]>
Received: from (know-mailgateway-2.server.virginmedia.net. [62.254.26.101])
by mx.google.com with ESMTPS id p3sm954300wic.8.2012.12.15.00.24.57
(version=SSLv3 cipher=OTHER);
Sat, 15 Dec 2012 00:25:02 -0800 (PST)
Message-ID: <[email protected]>
Received: from source ([103.6.169.29])
by smtp.virginmedia.com with SMTP; Sat, 15 Dec 2012 08:25:01 +0000 (GMT)
X-ProxyUser-IP: 103.6.169.29
Subject: M ;a s$t)u (r^ba "t ^l"n |g
Date: Sat, 15 Dec 2012 08:24:06 +0100
To: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
From: Qqchazv <[email protected]>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Gm-Message-State: ALoCoQmAAmRCQOGDDeamJp4WS+WHhYltgWWLxqriTEFxQiaZIaV7JlylggyEANw2J/TPwjbAG9x8

debuw http://odnovdw.pisem.su?qsrb gi hoq
qizu fabe zune nucery

Looks like your account is indeed sendng spam and the bounces are coming back to you.

tom_e · 17 Dec 2012 at 17:04

Yep looks like a spam bot is using your email address to send emails, not sure how you'd stop it though as they won't actually be being sent from your account.

ste-sim2x9 · 17 Dec 2012 at 17:04

So can i sort this?

KIA · 17 Dec 2012 at 17:29

Create a filter.

ste-sim2x9 · 17 Dec 2012 at 18:37

How do i create a filter?

prj1865 · 17 Dec 2012 at 20:50

Is it possible that his account has been compromised rather than someone using his address as the return?

I would start off by changing the password on my account to something long and complex.

Slam62 · 17 Dec 2012 at 20:53

Yes, change the password

demonix · 18 Dec 2012 at 15:39

Since Virgin Media uses gmail for it's mail service (if memory serves) you can just log into the webmail system and check the recent account activity to see if someone is accessing the account from elsewhere (it should list access from e-mail programs as well as direct access).

If there has been remote activity, then changing the password will keep them from sending any more spam using your account.

ste-sim2x9 · 18 Dec 2012 at 22:28

Ok thanks i'll look in to that, for the moment i've set another virgin emaol up and movied all my trusted contacts to there and will not use the new email for anything else. just don't understand why this has happened.

zakblood · 18 Dec 2012 at 22:42

i wouldn't post my own email or others here or anywhere else either tbh, or you may get some more spam, i'd edit it first, then run some spyware and virus scans on your pc, download ccleaner and malwarebyte or other types of free programs that do the same and clean it, for virus related cleaner use a good cleaner one active and one passive, so lets say your active one is nod32 then make your passive one kaspersky standalone or symantec corp standalone, remember to not use both in active mode, one has to be passive and not all will work together either so you will need to find 2 that does, i use a few.

spyware programs can be run the same way, as not any one will find everything so 2 is always better, same rule applies, one active one passive and your fine.

if all clear then go into your virgin mail box and take the tick out of keep copies of mail once delivered etc, so same crap isn't dl to more than one box / account if you have gmail / hotmail forwarding etc

tribz · 18 Dec 2012 at 22:51

One of your contacts has a virus.
The virus is sending bulk emails from the infected computer.
When its doing so, its using yours (and probably other peoples) email address as a reply address.
This masks where its really coming from and has the effect of you receiving the fall out/bounce backs.

Short version, someone has a virus and is sending out emails using your email address.
Not a lot you can do until whoever it is cleans their system up. Setting a new email address doesnt help in this instance as your infected contact is just as likely to send using your new address at some point if it knows it.

I've never seen a virus send emails out with the address of the infected person, they always use someone elses reply address.

KIA · 19 Dec 2012 at 10:49

tribz is correct. Create a gmail filter and move on.

demonix · 19 Dec 2012 at 16:37

KIA said:
tribz is correct. Create a gmail filter and move on.

I doubt it as that header shows that the e-mails are going through the virgin media e-mail system (which I doubt would happen with an infected computer if the computer in question doesn't have virgin media as an ISP) with an IP address originating in India (again if this was from an infected computer then the IP address would originate from the UK and not from another country), so the hacked account theory still stands.