Level 1

9 points

Outgoing Mail Virus, Yes, Virus!

My Apple Mail client has been sending out messages with no record of them in my Sent items. First I saw messages leave in the activity bar and now I'm getting confirmation as Undeliverable alerts are appearing for addresses I've never seen, some in Europe (I'm in the US). Further evidence is the appearance of automated replies from a subscription package tracking service I cancelled. This service is receiving messages from me that I am not sending.

I've installed ClamXav, Norton and Symantec and they found nothing. I've read other references to this issue at these discussions but so far no solutions. Can anyone help?

2 MBPs, iMac-24, Flower-Pot iMac, iBook, Original iPod, 2 Classics, 1 Touch, Mac OS X (10.5.7)

Posted on Dec 26, 2009 9:43 PM

54 replies

OrganicBooks Author

Level 1

9 points

Jan 11, 2010 9:03 AM in response to Tom Gewecke

I have no investment in finding a virus and am delighted if there are none. Your investment in there being none does not cancel out what people are seeing. "There are no viruses" does not automatically mean "there is no unusual activity in the status bar."

Király

Level 6

10,025 points

Jan 11, 2010 9:13 AM in response to OrganicBooks

OrganicBooks wrote:
"There are no viruses" does not automatically mean "there is no unusual activity in the status bar."

How many times do you need to be told?

The outgoing mail activity indicates that Mail.app is communicating with your IMAP server. That's it. It's not indicative of outgoing mystery messages, and the lack of any items in your Sent mailbox confirms that. So let go of that idea already.

OrganicBooks Author

Level 1

9 points

Jan 11, 2010 9:14 AM in response to Király

I suggest you balance your technical proficiency with some manners, sir. Frankly your manner has not earned sufficient confidence for you to me able to tell me to let go of anything.

Tom Gewecke

Level 10

122,082 points

Jan 11, 2010 9:22 AM in response to OrganicBooks

"There are no viruses" does not automatically mean "there is no unusual activity in the status bar."

If you continue to have what you consider to be unusual activity in the status bar, then come back here (or in the Snow Leopard Mail forum if that is what you are running now) with details about the kinds of email accounts you are running and exactly what you are seeing. I would expect that someone can provide you an explanation that does not involve anyone other than yourself sending emails from your machine (assuming it is not open to remote control via VNC or similar software).

Could you provide the urls of reports of other people seeing the kind of status bar activity which has been causing your concern?

Király

Level 6

10,025 points

Jan 11, 2010 9:39 AM in response to OrganicBooks

Whatever, dude, I have been patient enough with you already. I'm done.

OrganicBooks Author

Level 1

9 points

Jan 11, 2010 10:05 AM in response to Király

I am a woman, and that's exactly how I feel, minus the "whatever."

Jan 11, 2010 11:31 AM in response to OrganicBooks

I have seen issues with yahoo mail where your email gets compromised, but the person that broke your account just sets up a forwarding address in your account.

OrganicBooks Author

Level 1

9 points

Jan 11, 2010 12:21 PM in response to powerbook1701

Thank you, that could be it as the address in question is linked to yahoo mail. Still waiting to hear back from TRACKMYSHIPMENTS but I see that those forwards contain shipping information so the "autoforwarder" mentioned sounds like the culprit there. Still no more outgoing activity since Snow Leopard installation, contradicting the IMAP theory unless SL handles that differently.

Jan 11, 2010 12:43 PM in response to OrganicBooks

log into your yahoo account via web interface, check out the pop and forward prefs. See if someone placed a forwarding address there...

OrganicBooks Author

Level 1

9 points

Jan 11, 2010 12:51 PM in response to powerbook1701

Cool; thanks for your great instructions! Alas, there is no forward.

OrganicBooks Author

Level 1

9 points

Jan 11, 2010 12:58 PM in response to Tom Gewecke

What about this, then?

http://forums.cnet.com/5208-6132_102-0.html?threadID=293477

Tom Gewecke

Level 10

122,082 points

Jan 11, 2010 2:26 PM in response to OrganicBooks

http://forums.cnet.com/5208-6132_102-0.html?threadID=293477

Thanks for the link. I don't think the references there to infections found by ClamXav have anything to do with viruses or outgoing emails. They are instances of phishing (bogus emails which try to get the user to give up personal info by clicking on a link) which ClamXav thinks it has found in the user's mailboxes.

Any unusual outgoing email activity seen by the person asking that question would have to be caused by something else.

Jan 11, 2010 8:13 PM in response to Tom Gewecke

have you checked the imap settings under Mail- Preferences-Accounts-Mailbox behaviors?

There are settings there that have to do with sent mail and keeping copies of attachments, etc.

Tom Gewecke

Level 10

122,082 points

Jan 11, 2010 8:27 PM in response to powerbook1701

powerbook1701 --It is best to be more careful about whom you are responding to -- it wasn't me and it is possible the person you were trying to address will not see your message.

OrganicBooks Author

Level 1

9 points

Jan 11, 2010 8:31 PM in response to Tom Gewecke

I beg your pardon. I will indeed be more careful. I see nothing in the mailbox behaviors about imap settings. My accounts, save mobileme, are all pop if that means anything.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Outgoing Mail Virus, Yes, Virus!