Results 1 to 13 of 13
  1. #1
    Lounger
    Join Date
    Dec 2009
    Location
    Pacific NorthWest
    Posts
    26
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Each evening, beginning 24Feb, something seems to be blitzing a Hotmail Inbox. 3,000 or so items show up, no subject, no headers, and 232 Bytes. Aside from having an HTML lead-in, the only recognizeable text is the targeted email address and "IPM.Note".

    On the 1st evening, Outlook 2003 crashed. Perhaps that was the purpose, but it was under a non-Admin account, so whatever was intended may have been thwarted. Outlook has not crashed since.

    Anyone else being targeted?

  2. #2
    Super Moderator
    Join Date
    Aug 2001
    Location
    Evergreen, CO, USA
    Posts
    6,623
    Thanks
    3
    Thanked 60 Times in 60 Posts
    I would use the browser interface to investigate - it sounds like a spammer gone wonky. You should probably notify hotmail/msn/live and have them investigate.
    Wendell

  3. #3
    Super Moderator jscher2000's Avatar
    Join Date
    Feb 2001
    Location
    Silicon Valley, USA
    Posts
    23,112
    Thanks
    5
    Thanked 93 Times in 89 Posts
    Quote Originally Posted by Nano Geek View Post
    3,000 or so items show up, no subject, no headers, and 232 Bytes.
    Are these only in Outlook, or also on the live.com web site view of the Hotmail Inbox? If the problem is only in Outlook, there might be a bug in the "connector" that downloads the mail. But why overnight? Hmmm...

  4. #4
    Lounger
    Join Date
    Dec 2009
    Location
    Pacific NorthWest
    Posts
    26
    Thanks
    0
    Thanked 0 Times in 0 Posts
    OutlookConnector is in use, to fetch the emails. Attack (?) occurred again last night. Size of the email may be varying slightly, but it remains more than 200 and less than 300 Bytes.

    It is possible the person has become a target of some group, because a 2nd line of attack occurred this morning. It is more worrying, because the phisher used a valid account number at Dish Network. That incident was forwarded to report_spam@hotmail,com, spam@uce.gov and reportphishing@antiphishing.org .
    See: http://lounge.windowssecrets.com/ind...owtopic=772832

  5. #5
    Super Moderator jscher2000's Avatar
    Join Date
    Feb 2001
    Location
    Silicon Valley, USA
    Posts
    23,112
    Thanks
    5
    Thanked 93 Times in 89 Posts
    Quote Originally Posted by Nano Geek View Post
    OutlookConnector is in use, to fetch the emails.
    To rule out a problem with the software, has the user confirmed that the problem messages also in the online Inbox using the webmail interface?

  6. #6
    Lounger
    Join Date
    Dec 2009
    Location
    Pacific NorthWest
    Posts
    26
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Unlike previous days, an Email blitz occurred this morning. Perhaps the attack (?) is being pressed with more vigor...

    Report_spam@hotmail.com has been notified. Any other suggestions as to who to notify?

  7. #7
    Lounger
    Join Date
    Dec 2009
    Location
    Pacific NorthWest
    Posts
    26
    Thanks
    0
    Thanked 0 Times in 0 Posts
    The emails are not showing up when the Windows Live, Hotmail interface is used. Interestingly, the Inbox (other than the vapor emails) is tidy in Outlook 2003, but more 4,000 emails are list for the Inbox on Windows Live. They date back to July2009.

    Perhaps OutlookConnector is not playing all that well with Windows Live. I don't see any setting options (such as the old "Leave Message on Server"). I believe the old MSN Hotmail rule was that they swept email boxes clear periodically.

    Further investigation is beckoning (or looming, or ...) ...

  8. #8
    Lounger
    Join Date
    Dec 2009
    Location
    Pacific NorthWest
    Posts
    26
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Hmmm, there are "(No Subject)" emails from "(Unknown)" in the Inbox on the Hotmail server. I forwarded one to another email account. Disregarding the headers from forwarding, it seems to be like the suspect emails. They seem to be scattered among the good emails, and go back into 2009. Nowhere near enough of them to amount to 3,000, though.

    Peculiar !

  9. #9
    New Lounger
    Join Date
    Mar 2010
    Location
    USA
    Posts
    2
    Thanks
    0
    Thanked 0 Times in 0 Posts
    MSN is pretty aggressive about spam. They would not accept any messages that did not have headers. Also any messages which show the sender as unknown would be highly scrutinized. No subject is often a flag in spam filtering as well. It definitely sounds more like a connection issue with Outlook than a spam issue.

  10. #10
    Lounger
    Join Date
    Dec 2009
    Location
    Pacific NorthWest
    Posts
    26
    Thanks
    0
    Thanked 0 Times in 0 Posts
    It may be corruption of the .ost file that OutlookConnector uses. After moving some of the suspect emails to the Junk folder, then deleting the ost file, Outlook 2003 recreated the ost, then downloaded real emails where the placeholders (?) had been in the Junk folder. Suspect the misbehavior of OutlookConnector may be a variant of the old "multiple copies" of emails, that has long occurred with Outlook -- though to be fair, that may be a problem with internet protocol limitations/flaws, possibly aggravated by OutlookConnector use of MAPI.

    In general ScanPst is supposed to be able to work with .ost files. http://support.microsoft.com/ph/2520/en-us?sid=208 provides help with ost files for Outlook 2003 (though a misleading summary of KB829236). KB287497 describes recovering emails from either a pst or ost. Yet KB829236 mentions conditions where an ost cannot be corrected (such as email headers not downloaded). OutlookConnector (at least when used with Outlook 2003) has no options to change the email fetch options (such as "headers now, full later").

  11. #11
    Lounger
    Join Date
    Dec 2009
    Location
    Pacific NorthWest
    Posts
    26
    Thanks
    0
    Thanked 0 Times in 0 Posts
    A curiouser aspect is that for HTML format emails that made the roundtrip (from local ost to Live store and back to local) size and charset were altered. Size change might just mean more trip info in the headers. However a change of charset is odder. In the original emails (which had previously been moved from to other folders in a pst), charset was iso-8859-1. In the round-tripped emails charset had become windows-1252.

  12. #12
    Lounger
    Join Date
    Dec 2009
    Location
    Pacific NorthWest
    Posts
    26
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Appears to have been a problem with 12.1 version of OutlookConnector interacting with Outlook 2003. There were a lot of Sync Issues (hidden folder, at least to user of Outlook 2003). User was not ever advised by Outlook that a newer version of the Connector had become available, although 14.0 appears to have been released 20April.

    Installing Outlook Hotmail Connector 14.0 seems to have resolved the problem: http://www.microsoft.com/downloads/d...displaylang=en

  13. #13
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,571
    Thanks
    5
    Thanked 1,056 Times in 925 Posts
    Congratulations on your persistance. Glad you got it worked out. Thanks for posting back.

    Joe
    Joe

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •