Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Outlook sending unsolicited emails


  • Please log in to reply
6 replies to this topic

#1 ssutton503

ssutton503

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:57 AM

Posted 12 September 2016 - 02:14 PM

We host our email through GoDaddy which allows me to see how many emails each of our accounts send. I noticed one account having sent the maximum which seemed odd for that person. I feel like I have tracked it down to something sending emails in the background when Outlook is running. Let me say that again, the only time I see this unwanted behavior is when Outlook is running on this person's computer.

 

Another clue I have is that when I launch Outlook, I get an error that an incorrect domain is being used to send an email. While this error message is up, I do not get any unsolicited emails but once I click "OK" I will get more unsolicited emails until it hits anouther "incorrect domain" error. I can not find any of these emails in the Sent folder. I do not see them if I watch the Outbox.

 

I have run MalwareBytes scan (clean) AVG (clean) and Adwcleaner (clean now - found two things but nothing that fixed this problem) and still have the problem. I installed Thunderbird and let it run for several hours and no problems. It seems to me that the problem only occurs when Outlook is running but for the life of me, I can not find what the source of the problem is. I didn't find any suspicious programs running nor installed.

 

Short of stopping the use of Outlook, does anyone have any suggestions on how to get to the source of the problem?



BC AdBot (Login to Remove)

 


#2 Trikein

Trikein

  • Members
  • 1,321 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Rhode Island, US
  • Local time:08:57 AM

Posted 12 September 2016 - 02:50 PM

" I feel like I have tracked it down to something sending emails in the background when Outlook is running. "

 

Are you sure it's only when Outlook is open and not when the PC is just on? Usually malware wouldn't want for the application to open to send email. Also, how often?

 

"I get an error that an incorrect domain is being used to send an email."

 

What is the error exactly?



#3 ssutton503

ssutton503
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:57 AM

Posted 13 September 2016 - 03:12 PM

I have been making some changes to eliminate my email problem but if the error shows again, I will post details. In the meantime...

 

I deleted the user from Outlook and then imported his emails/folder/contacts back in from his old Outlook.pst file. No problems..... for about four hours. Then started getting the same behaviour mentioned before.

 

I have now created a new User account on his computer and setup his email, again, importing everything from his old .pst file. It has only been an hour so we will see what we see.

 

Trikein, I haven't seen his email count go up when his computer is running but Outlook is not. I have been wondering if these could be "legitimate" emails from Outlook (like a Calendar event notification) but then I wonder why I can't find anything in the Sent folder.

 

I may try letting him use Thunderbird for a while and see if the problem manifests itself via T-bird. I might also try deleting his Outlook profile, recreate his email account but do NOT import anything. Just to be finished with this problem, I might wipe his hard drive and reinstall everything. Shoot, I might even try going back to a Retosre point. I've never done that on a PC!

 

Thank you for your suggestions. If anything new develops I will post it here.



#4 Trikein

Trikein

  • Members
  • 1,321 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Rhode Island, US
  • Local time:08:57 AM

Posted 13 September 2016 - 04:54 PM

" I have been wondering if these could be "legitimate" emails from Outlook (like a Calendar event notification)"

 

Exactly what I was thinking. However, by importing the .pst you are replicating any possible bug.

 

"recreate his email account but do NOT import anything. "

 

If this works, you could slowly start integrating calendar and virtual folder until you see the problem re-appear. My guess is a broken calendar alarm. BTW, does the email client use SMTP for outbound?



#5 ssutton503

ssutton503
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:57 AM

Posted 13 September 2016 - 05:21 PM

Yes, the client uses SMTP for outbound. As a side question, what else would it use? I didn't know there was an alternative.



#6 Trikein

Trikein

  • Members
  • 1,321 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Rhode Island, US
  • Local time:08:57 AM

Posted 13 September 2016 - 08:16 PM

If you use exchange then you could use EWS, EAS or the older MAPI. It was the domain error that made me think in that direction. Perhaps the error is connected to the outbound emails.  Must be some system or ad on that Thunderbird doesn't support, and thus doesn't cause the problem. If you return to troubleshoot, please give specifics on the error. Verbatim quote, Screenshot, etc.


Edited by Trikein, 13 September 2016 - 08:18 PM.


#7 ssutton503

ssutton503
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:57 AM

Posted 15 September 2016 - 03:04 PM

As a follow up, I created a new user on the same computer, copied the user's documents and desktop, and finally restored his Outlook by importing his old Outlook.pst file. Knock on wood, all has been running okay. This gets us no closer to knowing what was actually going on but it does eliminate the problem. So far. ;-)

 

Thank you for your time and suggestions.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users