Delivery Status Notification (Failure)
Returned mail: Service unavailable
Delivery failure

I've been getting a lot of emails with the above subjects (a dozen a day at the peak), and when I look around for an reason why I would get these emails, searches say 'that it's an email delivery problem and I'm sending letters to parties/addresses that no longer exist'. The part that gets me though is that I haven't sent any emails.

Normally I would disregard these emails as spam, but I'm a little concerned that my email account may have been compromised by some sort of virus that's using my account to email others. I'm currently using Gmail if that helps, other than that I can't really think of anything else that may have caused it (unless the MSBlast worm I just killed has something to do with it). If anyone can advice me on this I'd really appreciate it.

Here are two examples of the emails.
======1st Example=======
<MAILER-DAEMON@ms15.hinet.net>
subject Returned mail: Service unavailable
mailed-by ms15.hinet.net
The original message was received at Tue, 15 Jan 2008 05:24:15 +0800 (CST)
from msx-sms2-8.hinet.net [168.95.7.28]
----- The following addresses had permanent fatal errors -----
<hunwang@ms15.hinet.net>
----- Transcript of session follows -----
mail.local: /var/mail/h/hunwang: Disc quota exceeded
554 <hunwang@ms15.hinet.net>... Service unavailable
----- Original message follows -----
Return-Path: <tsu.kao@gmail.com>
Received: from msx-sms2-8.hinet.net (msx-sms2-8.hinet.net [168.95.7.28])
by ms15.hinet.net (8.8.8/8.8.8) with ESMTP id FAA24200
for <hunwang@ms15.hinet.net>; Tue, 15 Jan 2008 05:24:15 +0800 (CST)
Received: from msx-sg2-9.hinet.net (msx-sg2-9.hinet.net [168.95.5.138])
by msx-sms2-8.hinet.net (8.12.11/8.12.11) with ESMTP id m0ELOEUM017519
for <hunwang@ms15.hinet.net>; Tue, 15 Jan 2008 05:24:14 +0800 (CST)
Received: from 168.95.5.15 ([60.217.216.84])
by msx-sg2-9.hinet.net (8.8.8/8.8.8) with SMTP id FAA02693;
Tue, 15 Jan 2008 05:23:50 +0800 (CST)
Received: from 61.58.186.224 by 60.217.216.84; Fri, 18 Jan 2008 17:15:59 -0400
Message-ID: <BAOIUIHNTPUNXLKCGMNR.JZXVKtsu.kao@gmail.com>
From: "LV 與 GUCCI 所有產品 皆附原廠紙袋(送禮方便)" <tsu.kao@gmail.com>
To: i03953h@ms15.hinet.net
Subject: PRADA BR- 黑BR3170
Date: Fri, 18 Jan 2008 23:14:59 +0200
X-Mailer: Internet Mail Service (5.5.2650.21)
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--82484784850735208"
X-Priority: 3
X-MSMail-Priority: Normal
X-Brightmail-Tracker: AAAABADs5YoBkSl7Am8/9Aev3IQ=
X-HiNet-Brightmail: Spam

----82484784850735208
Content-Type: text/plain;
Content-Transfer-Encoding: quoted-printable
.........gibberish follows....

=====2nd Example=====
MAILER-DAEMON@yahoo.co.jp to tsu.kao
Message from yahoo.co.jp.
Unable to deliver message to the following address(es).

<thom7ga40@yahoo.co.jp>:
Sorry your message to thom7ga40@yahoo.co.jp cannot be delivered. This account has been disabled or discontinued [#102].

<tiger231japan@yahoo.co.jp>:
Sorry your message to tiger231japan@yahoo.co.jp cannot be delivered. This account has been disabled or discontinued [#102].

--- Original message follows.

X-Originating-IP: [189.0.244.20]
Return-Path: <tsu.kao@gmail.com>
Received-SPF: neutral (124.83.171.182: domain of tsu.kao@gmail.com is neutral about designating 189.0.244.20 as permitted sender)
Authentication-Results: mta311.mail.ogk.yahoo.co.jp from=hotmail.com; domainkeys=neutral (no sig)
Received: from 189.0.244.20 (HELO 124.83.171.182) (189.0.244.20)
by mta311.mail.ogk.yahoo.co.jp with SMTP; Sat, 12 Jan 2008 09:46:43 +0900
Received: from 192.72.249.42 by 189.0.244.20; Tue, 15 Jan 2008 18:45:29 -0600
Message-ID: <YZVTAZEEBXPNGNVOMBSF@xuite.net>
From: "中南部可專案配合500萬以上、聯絡人:朱先生0910-926-146" <tsan_kenny@hotmail.com>
To: thom7ga40@yahoo.co.jp
Subject: 今天看房子.明天撥款.月息2分
Date: Tue, 15 Jan 2008 20:44:29 -0400
X-Mailer: MIME-tools 5.503 (Entity 5.501)
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--03070495878622138"
X-Priority: 1
X-MSMail-Priority: High
X-Antivirus: avast! (VPS 080111-0, 11/01/2008), Outbound message
X-Antivirus-Status: Clean

----03070495878622138
Content-Type: text/plain;
Content-Transfer-Encoding: quoted-printable

=A4=A4=ABn=B3=A1=A5i=B1M=AE=D7=B0t=A6X500=B8U=A5H=A4W=A1B=C1p=B5=B8=A4H:=A6=
=B6=A5=FD=A5=CD=A2=AF=A2=B8=A2=B0=A2=AF-=A2=B8=A2=B1=A2=B5-=A2=B0=A2=B3=A2=
=B5

1.=B1M=BF=EC=A5=C1=B6=A1=A4=A3=B0=CA=B2=A3=A4G=ADL=B3]=A9w=A9=F1=B4=DA=A4=EB=
=AE=A72=A4=C0
=A4=BD=C0=E7=BB=C8=A6=E6=A9e=A5=F4=B1M=B7~=A5N=AE=D1.=A5=FE=B5{=BF=EC=B2z
=A4=B5=A4=D1=AC=DD=A9=D0=A4l.=A9=FA=A4=D1=BC=B7=B4=DA

2.=BD=D0=B7=C7=B3=C6=B8=EA=AE=C6:
=A4g=A6a=A1B=AB=D8=AA=AB=A9=D2=A6=B3=C5v=AA=AC=A5=BF=A5=BB.=B3=CC=B7s=B5n=B0=
O=C3=AF=C1=C3=A5=BB(=A4T=A4=E9=A4=BA)
=A8=AD=A4=C0=C3=D2=A9=FA=A4=E5=A5=F3(=A4T=BE=DC=A4@)
(1)=A8=AD=A4=C0=C3=D2=A5=BF=A4=CF=AD=B1=BCv=A5=BB
(2)=A4=E1=A4f=A6W=C3=AF=A5=BF=A4=CF=AD=B1=BCv=A5=BB
(3)=A4=E1=C4y=C1=C3=A5=BB=A5=BF=A5=BB
=A6L=C5=B2=C3=D2=A9=FA(=A5b=A6~=A4=BA=A6=B3=AE=C4)+=A6L=C5=B2=B3=B9
=A9=D0=AB=CE=B5|=B3=E6(=B3=CC=AA=F1=A4@=B4=C1)=B5=F9=A1G=BF=F2=A5=A2=AA=CC=
=A5i=A6=DC=B5|=AE=BD=BE=F7=C3=F6=A5=D3=BD=D0
=A6a=BB=F9=B5|=B3=E6(=B3=CC=AA=F1=A4@=B4=C1)=B5=F9=A1G=BF=F2=A5=A2=AA=CC=A5=
i=A6=DC=B5|=AE=BD=BE=F7=C3=F6=A5=D3=BD=D0

3.=ABD=BF=FA=B2=F8,=B8=EA=AA=F7=A5R=B8=CE=BC=C6=A4Q=BB=F5
4.=C5w=AA=EF=A6P=A6=E6.=A9=CE=A5=F2=A4=B6

5.=A9=D0=AB=CE=A6a=C2I:=A5x=A5_=A5=AB=A4=CE=A5x=A5_=BF=A4=AC=B0=A5D=A8=E4=A5=
L=AA=BA=A6a=C2I=A5H=B7=ED=A6a=AA=F7=A5D=B3=F8=BB=F9
(=A6p=A4=A4=ABn=B3=A1.=A5=D1=B7=ED=A6a=AA=F7=A5D=B3=F8=BB=F9)

=C1p=B5=B8=A4H:=A5x=A5_=A6=B6=A5=FD=A5=CD0910926146
=A4=CE=AE=C9=B3q:F544435
skype:F544435
=BA=F4=B8=F4=B6=C7=AFu:0945672363(=B5L=C1=D9=B4=DA=AF=E0=A4O=BD=D0=A4=C5=A8=
=D3=B9q)

ps:
=A8=C3=A7=E4=B4M=A9=D0=A4l.=A9=CE=A4g=A6a=B6R=AEa=A5i=B9w=A5=FD=ADq=C1=CA=A6=
]=A6=B3=B6U=B4=DA=A4H=B7Q=AA=BD=B1=B5=BD=E6=B1=BC=A9w=A4=F1=A5=AB=BB=F9=A7=
C
=A4=A3=A5=CE=B6R=A4=E8=A5I=A5=F2=A4=B6=B6O.=B1M=A4H=ADt=B3d=A5N=AC=DD=A9=D0=
=A4l.=A4=BD=C0=E7=BB=C8=A6=E6
=AFS=AC=F9=A5N=AE=D1=C3=B1=AC=F9.=A5=FE=B5{=A6=B3=ABO=BB=D9

=B1M=BF=EC=A5=C1=B6=A1=A4G=ADL=A9=F1=B4=DA.=A4=EB=AE=A72=A4=C0


----03070495878622138--


*** MESSAGE TRUNCATED ***

Recommended Answers

All 5 Replies

You might have a virus thats sending out emails from your PC or more likely, someone is spoofing your email address (easy to do if the smtp mail server is unsecured - thats how spam emails can sometimes appear to originate from legitimate companies)

Ran my McAfee and Ad-aware, but I didn't turn up any viruses. Do you have any suggestions for finding out if my computer has been infected?

most likely is that someone is using your userid to send mail thorugh your mail server. Unless your outgoing server has password protection you cant stop this (most ISP servers DONT)

This is phishing or malware spam

It has nothing to do with your computer or your email service. The notices are phake. This is usually used for phishing, advertising, or downloading malware to your computer.

The entire notice was dummied up to fool you. No undeliverable email mentioned in the notice ever existed. The phakers are trying to get you to click on the links in the email. When you do that, they can do whatever they want to you.

In this case, the numbers at the bottom were an attempt to install malware on YOUR computer. It was sanitized by your ISP.

Just throw them out without opening them or following any links.

K thanks Midimagic, that helps a lot. It's nice knowing my account isn't being used by someone else.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.