Is this a virus or not?!

[Joe Marshall]

I have started getting a lot of "Failed delivery" notices, claiming that SPAM emails were sent from my address. These feature the correct address after the @ symbol, but a random collection of letters before it (e.g. one might claim to come from xpqstvz@Rest of my address...).

Is this a virus in my computer, or is someone else just using my email address to generate these (the address leaked out via various web pages when I was organising conferences)?

If is IS a virus, can anyone tell me its name etc. If not, is there anything I can do, short of setting up a new email address and blocking out the previous one?

(note I cannot find anything via an AVG search, and I have both AVG and Zone Alarm running to prevent Outlook Express sending messages without an OK from me).

[Dani]

Enable authentication on your SMTP server so that anyone can't just use your mail server to send out email.

[Joe Marshall]

I will try. However, the computer is in my house, and I live alone!

[DMR]

or is someone else just using my email address to generate these

I just worked through this issue with one of my clients last week, and we found that the "Mailer Daemon", "Failed Delivery", etc. messages were indeed coming from the outside, and were forged. They were not the result of malicious activity on his computer; his system was 100% clean.

If you're getting enough of these incoming emails to bother you, your only choice is to filter them as Spam; the exact method of filtering will obviously depend on your particular mail software/setup. You shouldn't have the filter software automatically delete them though, as you will occasionally get valid "undeliverable" messages in response to emails which you have knowing sent from your computer.

[Joe Marshall]

I just worked through this issue with one of my clients last week, and we found that the "Mailer Daemon", "Failed Delivery", etc. messages were indeed coming from the outside, and were forged. They were not the result of malicious activity on his computer; his system was 100% clean.

If you're getting enough of these incoming emails to bother you, your only choice is to filter them as Spam; the exact method of filtering will obviously depend on your particular mail software/setup. You shouldn't have the filter software automatically delete them though, as you will occasionally get valid "undeliverable" messages in response to emails which you have knowing sent from your computer.

I think you have it spot on! I tried operating from another computer which has not been connected to the web, and with every available firewall to stop anything being emailed out without my express permission. I still got the same incoming messages. My conclusion, like yours, is that someone has my email address and is doctoring it with the random letters before the @ symbol.

Sadly, although it is possible for me to reject specified incoming addresses, it does not seem possible to ONLY ACCEPT those with the correct full address under Outlook Express (BUT WHY NOT!, if anyone out there is listening!). Even then, if someone sent (say) a joke to "Undisclosed Recipients", it would probably get rejected unless Outlook Express was much more sophisticated than it presently is!

As you also said, I can set it to reject incoming emails which contain specific letters (e.g. x, z, q) which are not in my address, but then if the message happens to be sent to me plus someone else with such letters in THEIR address, it would probably get blocked). I guess I will just have to put up with it, or go to all the hastle of changing my total address!

Thanks for the advice anyway! I hope it is spotted by anyone else with the same problem!

[DMR]

Outlook Express doensn't have a lot of firepower when it comes to filtering/spam blocking, but you can create a Mail Rule which filters based on the sender's name. One common trait I saw with my client's bogus emails was that the sender was always some variation of the usual "undeliverable" mail server auto-responder, so filtering out the sender names "Mailer-Daemon" and "Delivery subsystem" should block most (if not all) of the messages.