1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

No delivery of no mail sent !

Discussion in 'Security and Privacy' started by jbarker, 2004/03/30.

Thread Status:
Not open for further replies.
  1. 2004/03/30
    jbarker

    jbarker Inactive Thread Starter

    Joined:
    2003/05/21
    Messages:
    238
    Likes Received:
    0
    OK, we've just been waiting for this to happen so we could ask all you folks "Just what the heck is going on ? "

    OS is Windows XP Pro
    Anti Virus is Norton - updated to latest !
    Spyware remover has been run and all is clear.
    Tracks Eraser has cleared all cookies, temp files, history etc.
    E-mail system is Outlook Express - there is not one bit of mail in the system - period.

    So, we log into Outlook Express and we get a new e-mail !
    It is a notification of "Failed e-mail delivery ".
    The time was just now !
    We haven't sent any mail out in two days.
    They just keep showing up - all different !

    It does not ask for any information or require we do any clicking etc. I guess they got what they needed when we just looked at it.

    OK folks, who is getting past all our saftguards now ?

    How do we prevent such?

    Do we need additional software - hardware?
    Got all software updated now - we also got a "hard" firewall between modem and computer.
     
    jbarker,
    #1
  2. 2004/03/30
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Very possible it's just Mail Address Spoofing, but if you want to be sure, do some online virus scans and/or post a HijackThis log.
    By hard firewall, do you mean a router, and if so does it have SPI? Do you have a software firewall to monitor outgoing?
     
    Last edited: 2004/03/30
    noahdfear,
    #2


  3. to hide this advert.

  4. 2004/03/30
    jbarker

    jbarker Inactive Thread Starter

    Joined:
    2003/05/21
    Messages:
    238
    Likes Received:
    0
    Yes, the hard firewall is a "router ".
    I'm not good eneough to tell if it.........(anything) !

    We have no idea of what you mean by "SPI ".

    And we do not have any firewall software.

    Only knew that the "router" was a "Firewall" because the computer store salesman said so.

    We did read the linked documents - there was one statement in it that said we are out of luck when trying to prevent "Spoofing ".

    Would appreciate all the help we can get here.
    It is occuring all too often.

    Another thing - may be related.
    When an activity happens there is a little box at the bottom of my screen that shows a little green dashes until the box is full - then it is gone.

    That has occured three times as we have been typing this information. Could that be some of that "outgoing" stuff you mention ? We haven't the slightest idea why. Number four just occured !

    OK, you see how much we don't know - thanks for helping.
     
    jbarker,
    #3
  5. 2004/03/30
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    SPI- Stateful Packet Inspection
    That means information sent to and from your computer is in the form of 'packets', and your router examines each of these packets. If incoming packets don't correspond to any outgoing packets requesting info from your computer, they are denied entrance. A good defense against hackers.

    A software firewall will allow only the programs that you specify access to the internet, and will prompt you if another wants out.

    While both of these types of security are very good to have and add a good measure of protection, should a computer get infected, say through an email attachment or file transfer, it could use a program that already has been given internet access to fool the software firewall, and the router would see the information being sent out as valid.

    The best thing to do is run some online virus scans. If none of them find anything, I think you can chalk one up to spoofing, and just delete all future messages.

    eTrust online scan in my signature.
    RAV

    PC Pitstop

    TrendMicro

    If you are still concerned, and would like to post a HijackThis log, you can get it here. Install it to a permanent folder. Open and click the scan button, then save log. When you save, it will open up in notepad. Click edit>select all, edit>copy and paste it here. Don't fix anything with it unless instructed to do so. Most of the information it displays is valid and needed.


    BTW, could you give more info on the little green box that flashes? Where exactly is it located? Tray? Bottom of IE window? Does it display any information when you hover on it with pointer?
     
    Last edited: 2004/03/30
    noahdfear,
    #4
  6. 2004/03/30
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2
    What router do you have?
     
    Newt,
    #5
  7. 2004/03/30
    jbarker

    jbarker Inactive Thread Starter

    Joined:
    2003/05/21
    Messages:
    238
    Likes Received:
    0
    Routher is a Belkin Mod. F5D5231-4.

    Did the virus scans - found none.

    Tray - what is that?

    Green lights show at botton of IE screen.
    There is a long box there - and data flashes as we move mouse around screen.

    A smaller box about 1 1/2 inches long appears there - then within it a small green square. then a series of little green squares until the box is full. Then it is gone.

    All this occurs fast - no chance to survey with mouse.

    Thanks
    Perhaps we're ok !
     
    jbarker,
    #6
  8. 2004/03/30
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    I think the box you're looking at is the status bar. Click view and uncheck status bar to verify. Should go away. If so, it's normal for the box to become active. It's refreshing the page. The data you see when moving the mouse is information about the particular object it's pointing at. Point at a link and it show's the address, etc.
    Glad you got a clean bill of health on the scans. :)
     
    noahdfear,
    #7
  9. 2004/03/30
    Christer

    Christer Geek Member Staff

    Joined:
    2002/12/17
    Messages:
    6,585
    Likes Received:
    74
    I get those too every now and then. Not until today did I get one with an "intended delivery address" that I recognized from my own address book. I haven´t sent an e-mail to that address in months.

    Am I right in assuming that someone with both me and my friend in the adress book has been infected with something ...... :confused: ...... nicking the addresses?

    Christer
     
    Christer,
    #8
  10. 2004/03/30
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2
    Routher is a Belkin Mod. F5D5231-4

    Then you do not have a hardware firewall as part of the router. You do have the protection that NAT offers (see pinned article in the networking section for details).

    Several of the places that have the device for sale (including the Belkin site) speak of it's NAT Firewall but that is a seriously misleading term.
     
    Newt,
    #9
  11. 2004/03/30
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Christer,

    I would lean towards saying yes. Or your friend, which would have your address in his/hers.
     
    noahdfear,
    #10
  12. 2004/03/31
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Have a look in the Pending mail Folder.

    The Belkin model referenced above does hase SPI.
    http://www.microcenter.com/single_product_results.phtml?product_id=0151876

    http://www.smallnetbuilder.com/Sections-article18-page1.php

    All consumer grade routers are based on Network Address Translation. This is the technology that lets you have multiple computers on your LAN (which each have their own IP address) communicate with the Internet through the single IP address that your Internet Service Provider / Broadband Service Provider (ISP / BSP) assigns to you. NAT also provides a basic firewall, since it only allows data from the Internet through it if that data is the result of a request that originated on a computer on your LAN. Since NAT requires that the router look at (or inspect) part of each data packet that passes through it, why isn't that considered SPI?

    Turns out that the answer to this question is the subject of some amount of debate in the industry, partially due to the term's misuse by some companies to describe early NAT-based products. It's also difficult for the average purchaser of a router to verify actual SPI operation. On a practical basis, however, it's not so much a matter of NAT vs. SPI, but a question of the feature set you desire. "SPI" based consumer routers can usually be differentiated from their plain-vanilla cousins by the presence of features like emailed attack alerts and reports, although exceptions can be found to this rule. In the end, SPI is being mainly used as a way to charge more for a product that has rapidly moved down the price curve to become a commodity.

    Recommendation: If the only difference in features between the products that you're considering is that one has SPI and the other doesn't, choose the SPI product if you tend to use a lot of mapped ports, or you're hosting some sort of server behind your router. Otherwise, plain ol' NAT should do just fine.

     
    Last edited: 2004/03/31
    TonyT,
    #11
  13. 2004/03/31
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2
    Thanks TonyT. I looked around quite a bit before posting that it didn't have a firewall. Guess I shoulda looked some more.
     
    Newt,
    #12
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...