Now I'm a SPAMMER?

I know of software to stop spam but now somehow my e-mial is sending spam. Whenever I've even sent 3 e-mails with the same subject to friends McAfee has stopped them and said -- possible spam...do you want to continue. So obviously this is not going on from my computer per se but "out there" somewhere.

OK -- once again I can't get info to copy over like I want so I'm going to use an attachment since I copied info from the web and I want you to see it exactly like they worded it.

 

I would say that this is a classic case of e-mail spoofing:
http://service1.symantec.com/SUPPOR...88256c5c0080549f?OpenDocument&src=bar_sch_nam
http://www.cert.org/tech_tips/email_spoofing.html http://ferl.becta.org.uk/display.cfm?resID=6837

It maybe that both e-mail addresses are in some other person's address book that had picked up a virus that generates this activity.

However, with regard to your McAfee product trapping out 3 e-mails with the same subject this may be normal behaviour of the product, presumably in the "Monitors and filter multiple email accounts" functionality of http://us.mcafee.com/root/package.asp?pkgid=123&WWW_URL=www.mcafee.com/myapps/msk/

...or were you saying that your machine appears to be generating 3 e-mails of the same subject not initiated by you? If so, take a look at: http://www.majorgeeks.com/vb/showthread.php?t=26149 to see if there is a rogue process and http://www.majorgeeks.com/vb/showthread.php?t=27387

Can you post some information about your system and the McAfee product that you are using?

 

Answer to Deyb

Deyb gave me the following answer because I started this under the thread "Spam" and then re-started it under my own thread (I said that in my post) which is probably a no-no:

Pegg,

Your email address isn't labeled as a spammer, your email provider, the email server op1.xlccorp.com has been labeled as a spammer because of all the complaints to SpamCop....

The mail server at chapelhillchurch.org has been set up so that any email coming from xlccorp.com is blocked. ...

I do find it curious that your email provider has a division devoted to servicing people concerned about spam: http://www.highstream.net/internets...ent/aboutus.asp

If you want to be active, you could forward the information you posted to their support email: support@highstream.net . I didn't find an abuse@ email on the site or in their DNS info, so hopefully your complaint will get to the proper person.

Now -- I DO NOT have highstream.net as my ISP but that is a division of XLC Corp. I have allvantage.com as my ISP. I even went to highstream and tried to log on to see if I have an "account" but I don't. BUT - eventually, I discovered on www.allvantage.com a place where it took me to this: https://www.truste.org/validate.php?invnum=14053&fromcgi=1 which mentions [font=Arial, Helvetica, sans-serif]This confirms that QualGuard, Inc. / XLC Corp. is a licensee of the TRUSTe Privacy Seal Program. The privacy statement from which you came discloses the privacy practices for www.allvantage.com.[/font]

so the answer is to NOT use this ISP? That's it. I have to change my e-mail and all that entails. But of course I want to know WHY? The server has had complaints but it isn't about MY EMAIL address right? Just anything to do with them in general then?

 

Yes, I meant it is NORMAL behavior of checking e-mails coming from me -- that's why I didn't think anything was actually being generated from my machine, so to speak.

WINDOWS XP
version 2002
service pack 1
Dell, Pentium 4
McAfee Virus Scan ? Um, I have the security system: firewall, spam killer -- can't seem to find a version or anything. I know that's lame...

 

This must mean something. I just went into my Outlook Express, tools, account and started checking what is marked, checked etc on all the tabs. Something had been CHANGED under the "servers" tab -- I don't remember doing this although I looked into making things more secure.

For incoming mail service is a POP3 server (that didn't change)
next comes "incoming mail (POP3)": should have said "pop3.allvantage.com" but instead it said 127.0.0.1

(edited and added
OK -- wait a minute -- I just looked into this and now I know that 127.0.0.1 is my local host - or my computer I guess. Anyway -- is that a good thing to have it be that ip?
Now I'm even more confused

 

That appears to be normal set-up for an anti-spam product. See for example: http://www.spampal.org/usermanual/quick_start.htm and http://www.astonsoft.com/help/index.html under section 4.5.3.6.3

 

Whenever I've even sent 3 e-mails with the same subject to friends McAfee has stopped them and said -- possible spam...do you want to continue.
Okay pegg, that's just your resident protector doing it's job. Notice that McAfee (shudder! get rid of that so called "security" app. please. you'll never regret letting it go--but that's another subject ) is asking you if this is spam. It's not your isp or account asking, it's your own application. You should be able to go into configuration and fix that (though with the big M'Fee it might be hard). Anyone out there who remembers how to config. McAfee chime right in.
Bill
(edit: at least that's what it looks like to me because of the way pegg's post is worded.)

 

pop3 was changed AGAIN TODAY

Last night I had changed 127.0.0.1 back to pop3.allvantage.com, today I went to check e-mail and the box popped up for a millisecond saying it was checking and then disappeared with no e-mail (unusual for me with a large family).

So, out of curiosity I went and checked the servers tab again and the pop3.allvantage.com had SOMEHOW been changed back to 127.0.0.1 HOW COULD THAT HAVE HAPPENED?

I fixed it, checked my e-mail and had 5 messages.

EDIT: I just got this reply from my ISP:
We were temporarily listed in Spamcop because some users had viruses, which sent out mass emails from AllVantage accounts. We have cleared this up with Spamcop and we will be delisted with them shortly.

So - I can believe that - but now I want an answer to the above stuff I typed in blue. Is this strange? Have I put something in my computer that is changing this? Does it have to do with securtiy? TCP/IP etc...

 

I never was until yesterday I downloaded from McAfee a free 60 day trial of their SpamKiller.
But this 127.0.0.1 rings a bell. I know I never went into my email and changed it but I think I looked at a program that talked about how you can use that to fool websites into not sending your info out to others....but I didn't want to install it 'cause I didn't think I'd need that...

So any idea what that might have been? (I would have seen it here, otherwise I don't think I would have even looked at it). Maybe that effected something. Maybe I opened it, then tried to "uninstall" but didn't really, I don't even remember.

I don't know what K9 is -- but, like always, I'll look into it. If the problem was my ISP like they said, do I still need to get something since it wasn't ME. (I know, protection, protection, and I don't mind doing something, but again, I want to get to the bottom of this 127.0.0.1 thing and why it keeps changin in my email security properties when I'm not doing it)

 

Do you still have McAfee Spamkiller installed? Have you looked at the FAQ at http://ts.mcafeehelp.com/default.asp?siteID=1&cnrcheck=done&resolution=1024x768

I would expect that the product will self-check that the configuration is as it expects along the following lines:

Manually setting up a POP3 account with Outlook Express and SpamKiller 5

Set POP3 account information in SpamKiller

Right-click on the 'M' icon.
Open SpamKiller.
Click on the Settings tab.
Click on E-mail Accounts. Remove any that are currently there.
Click on the Add button.
If your account is in the list, highlight it and click on the Next button. If it is not in the list, check the box, click Next and type in the email address for the account you wish to setup.
Enter in the password for this account and click Next.
Choose your connection type and click Next.
Click on the Test button to verify that SpamKiller can login using the information just entered.
Click on the Next button and then Finish.
Point Outlook Express to get mail from SpamKiller

Open Microsoft Outlook Express.
Click on Tools and select Accounts.
Select your mail account and click Properties.
Highlight your POP3 account and click on Change.
Under the Server tab, change the Incoming mail server address to 127.0.0.1 (if it isn't already).
Under the Incoming Mail server heading, change the Account Name to your full email address. (if it isn't already)
Click OK button and then the Finish button

 

RE: what Maxwell is telling me to go and check:

Well, yes, this seems to be exactly what SpamKiller did on its own when I installed it. You are so smart.


Except I wasn't able to get mail when it was set up like this and when I changed it back to how I knew it should be I could get mail (and those people had already been on my "friends" list)....so it must have set something up but maybe something got missed or messed up. I'll go through all those steps and we'll see what happens.

 

so far so good

Well - I had to try several different settings when I went back in to configure Spamkiller again but finally I got it to actually check my mail with spamkiller in operation. I had to use my "username" that signs on to my server (which isn't just my email name).

Then the spamkiller directions said to use "localhost" in place of the pop3.allvantage.com where I kept finding 127.0.0.1 (?) So I don't know if I'll go in later and actually find the numbers but I know it means the same thing.

Thanks for helping out li'l ol' me.