Member Avatar for whiskeyjar2005

Please help - a colleague of mine noticed yesterday that e-mails were being generated from his machine to people in his address book with a dead link as the subject line:
Microsoft Outlook Web Access:
The subject line of the e-mail is vv . bv
The colleague has received numerous e-mails from people saying they cannot open the link, and it appears that the e-mail is attempting to invite them to a meeting with a date in April. One person who received the e-mail actually received an invitation to join the meeting; everyone else has attempted to click on the link, but nothing happens.
The machine is running XP with Outlook 2003. I have scanned it with Symantec AV and Microsoft Spyware software, but nothing has been found. Any suggestions?

  • 2 Contributors
  • 4 Replies
  • 224 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by whiskeyjar2005

Dani AI

Generated

Short, practical checklist and context to help pin down what happened and stop it from recurring.

The OWA-style path and an internal ".EML" reference in the subject are strong clues that something created or referenced a saved message object in the affected mailbox and then propagated meeting requests. That can result from a compromised mailbox (Send As/delegate access or stolen credentials), an Outlook rule or add-in misbehaving, or automated malware that uses Outlook/MAPI to generate invites. Since already ran local scans, focus next on tracing the message origin and preserving evidence before wiping anything.

Immediate diagnostic steps (in this order):

  • Save a complete sample of an offending message, including full headers and the raw source. Preserve a copy outside the user profile.
  • Check the user’s Sent Items and the server-side message-tracking/logs to confirm whether the messages were actually sent from that mailbox or merely forged.
  • Inspect mailbox rules, delegates/Send As permissions, and calendar objects for recently created items or attachments referencing .EML files.
  • Examine message headers: follow the Received: chain and Message-ID to find the originating IP/client.
  • If you have admin access, search the Exchange mailbox store for stray .EML items and review OWA/HTTP logs for automated requests.

Containment and remediation:

  • If the mailbox or workstation is confirmed compromised, isolate the machine, reset the account password, revoke active sessions, and enforce multifactor authentication for the account.
  • Remove any malicious rules, delegates, or unexpected calendar entries; disable suspicious Outlook add-ins and scheduled tasks; run a thorough offline antivirus/antimalware sweep.
  • Patch Outlook/Windows and update server-side antivirus and mail hygiene tools.

Preservation, follow-up, and prevention:
Keep logs and a sample message for later analysis. Ask whoever resolved the incident to document exactly what they changed so you can close gaps. Long term, limit Send As rights, block automatic external forwards, monitor message-tracking for spikes, and implement mailbox auditing and stronger authentication to reduce the chance of recurrence.

Recommended Answers

All 4 Replies

Member Avatar for DMR

In addition to your Symantec scan, you should do a least two of the following free online virus/spyware scans; they may catch things that Symantec didn't:

http://www.kaspersky.com/scanforvirus.html
http://housecall.trendmicro.com/
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
http://us.mcafee.com/root/mfs/default.asp?cid=9914

Let us know what (if anything) those scans found, and if they were able to remove the mailer infection.

Member Avatar for whiskeyjar2005

Thank you for the suggestion. I will try that and let you know.

Member Avatar for DMR

OK; we'll be here...


If the online scans don't help, do the following:

Download the (free) .

Once downloaded:

Create a folder outside of any Temp/Temporary folders for HJT and move it there. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...". Save the log in the folder you created for HiajckThis, open the log in Windows Notepad, and cut-n-paste the entire contents of the log here.

The log contents can tell us a lot about what "nasties" have crept into your system, and once we analyse the log we can tell you what to do from there.

Member Avatar for whiskeyjar2005

Thank you so much for the suggestion. Someone else took over the problem while I was at lunch and all appears to be well (the person was in a hurry and needed it NOW), so I have no more to report. I appreciate your responses and advice.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.