My account is sending spam and I can't stop it!

Question

My account is sending spam and I can't stop it!

For almost two months now my account has been sending out hundreds of spam mails to known contacts and also unknown email addresses.

I contacted my domain name provider (nominalia.es) and they advised me to do a few things:

1 Change my email password, as well as the outgoing smtp password (Done. Twice.)

2 Install an antivirus. (I have Avast Mac Security. No viruses or other problems found),

3 Remove my email address from my website. (Done).

Despite having followed all their advice the problem continues as before.

This is so annoying as I am a business user and I'm spamming all my clients as well as friends and family. I need to make this stop. I have thought about abandoning my domain name and starting afresh with a new one, but as a long established business I really don't want to change my web address and email address unless absolutely necessary.

Any help would be much appreciated.

(I wanted to post this in a Mail community, but can't find one. Please move my message if there is a better location for it).

MacBook Pro, OS X El Capitan (10.11.3)

Posted on Sep 24, 2016 1:33 AM

Reply

Answer 1

Roh003

Level 1

4 points

Sep 24, 2016 4:20 AM in response to LibertyEnglish

I'd first like to understand the situation better.

Are the emails being sent in bulk, or are they being sent periodically to different emails at different times?

If you have another Mail Client, I'd suggest you switch to that, and see if the problem persists.

Reply

Answer 2

Sep 24, 2016 4:33 AM in response to Roh003

Hello

I would say that approximately twice a week I log into my email to find dozens of emails have arrived en masse overnight from the Mail Delivery Service stating that it has not been possible to deliver my (spam) emails to ........ (and the email address of my latest victim). So the messages are going out in bulk about twice a week.

If it was not for this Mail Delivery Serviced failed email messages I wouldn't even know that I have been spamming people.

I dont have any other Mail Client.

Reply

Answer 3

Roh003

Level 1

4 points

Sep 24, 2016 5:58 AM in response to LibertyEnglish

Do these (spam) emails appear in your Sent mailbox?

If they do, please copy the full header of any of the spam emails along with the header of another (not spam) email.

If it is a spammer using your account in some way, we will find out from the header as it will tell us where the mail was sent from.

To view the headers of an email, select the message and press CMD-SHIFT-H, or View > Message > All Headers.

I'd recommend using another Mail Client or accessing your Mail online for the time being.

Reply

Answer 4

Eric Root

Level 10

684,027 points

Sep 24, 2016 9:35 AM in response to LibertyEnglish

If the e-mails aren't in your Sent mailbox, someone else may be spamming using your e-mail address.

Reply

Answer 5

Sep 24, 2016 10:48 AM in response to Roh003

Hello

No, they do not appear in my sent box.

I can't copy the header as you have suggested.

Reply

Answer 6

Sep 24, 2016 11:10 AM in response to Eric Root

This is what I assume is happening. But how do I make it stop?

Reply

Answer 7

KiltedTim

Level 10

195,189 points

Sep 24, 2016 11:25 AM in response to LibertyEnglish

Unfortunately, you can't. Just like you can't stop someone from sending out postal mail (snail mail) and putting your address on the envelope as the return address. When it comes to electronic mail, that's just the nature of the beast. Forging the return address is trivially easy.

Reply

Answer 8

Sep 24, 2016 12:06 PM in response to KiltedTim

KiltedTim, but unfortunately that is not what is happening.

Large numbers of spam emails are being sent from my email account (my domain provider has confirmed this).

It is not a forged return address. The emails are coming from me. They just don't appear in my sent folder.

Some of the emails go to my contacts, some go to emails that I have never heard of before.

I thought changing my outgoing smtp password (twice) would be enough to make it stop, but sadly not.

Reply

Answer 9

KiltedTim

Level 10

195,189 points

Sep 24, 2016 12:07 PM in response to LibertyEnglish

If they are actually being sent through your account, then change the password for your email account. If that doesn't fix it, it's likely your email provider has an open smtp relay that does not bother to authenticate the sender.

This is a problem you'll have to work out with your email provider.

Reply

Answer 10

Sep 25, 2016 7:45 AM in response to KiltedTim

Yes, the emails are being sent through my account. I have changed my password twice, including the outgoing smtp password.

When I contacted my domain name provider their advice was to change my email password (see original post).

I'm just not getting anywhere and don't know how to make this stop.

Reply

Answer 11

KiltedTim

Level 10

195,189 points

Sep 25, 2016 7:50 AM in response to LibertyEnglish

This issue has absolutely nothing to do with Apple or any Apple product. We can't help you beyond the suggestions we've already made. You need to take it up with your email provider... again. If they can't resolve it, then you should probably look into switching providers.

Reply

Answer 12

Eric Root

Level 10

684,027 points

Sep 25, 2016 9:46 AM in response to LibertyEnglish

Very long shot.

Try running this program in your normal account , then copy and paste the output in a reply. The program was created by Etresoft, a frequent contributor. Please use copy and paste as screen shots can be hard to read. On the screen with Options, please open Options and check the bottom 2 boxes before running. Click “Share Report” button in the toolbar, select “Copy to Clipboard” and then paste into a reply. This will show what is running on your computer. No personal information is shown.

Etrecheck – System Information

Reply

Answer 13

Sep 28, 2016 10:07 AM in response to Eric Root

Hi Eric

Thanks for the reply. I've followed your instructions and I've copied the report below.

At the same time I've been posting on this board, I've also been communicating with my email service provider. Their latest suggestion was to remove my email from my website. I had a link to my email address, but the actual email address itself was not displayed. I'm not sure if I'm explaining myself well. What people could see on the website was the word EMAIL, and when they click on that link a window would open up for them to be able to send me an email. I was aware that you shouldn't display your email address on your website because 'bots' can pick it up but, maybe mistakenly, I thought it was safe to put a link to your email address. Anyway, I have completely deleted my email from my website now. I don't know if this will somehow solve the problem or if they are sending me on yet another wild goose chase!

EtreCheck version: 3.0.5 (309)

Report generated 2016-09-28 19:00:49

Download EtreCheck from https://etrecheck.com

Runtime 5:20

Performance: Below Average

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

Click the [Remove] links to remove adware.

Problem: Other problem

Hardware Information: ⓘ

MacBook Pro (13-inch, Late 2011)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Pro - model: MacBookPro8,1

1 2,4 GHz Intel Core i5 CPU: 2-core

4 GB RAM Upgradeable - [Instructions]

BANK 0/DIMM0

2 GB DDR3 1333 MHz ok

BANK 1/DIMM0

2 GB DDR3 1333 MHz ok

Bluetooth: Old - Handoff/Airdrop2 not supported

Wireless: en1: 802.11 a/b/g/n

Battery: Health = Normal - Cycle count = 1155

Video Information: ⓘ

Intel HD Graphics 3000

Color LCD 1280 x 800

System Software: ⓘ

OS X El Capitan 10.11.6 (15G1004) - Time since boot: about 9 days

Disk Information: ⓘ

ST9500325ASG disk0 : (500,11 GB) (Rotational)

EFI (disk0s1) <not mounted> : 210 MB

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

Macintosh HD (disk1) / : 498.88 GB (191.97 GB free)

Encrypted AES-XTS Unlocked

Core Storage: disk0s2 499.25 GB Online

OPTIARC DVD RW AD-5970H ()

USB Information: ⓘ

Hewlett-Packard HP Color LaserJet Pro M252dw

Apple Computer, Inc. IR Receiver

Apple Inc. FaceTime HD Camera (Built-in)

Apple Inc. Apple Internal Keyboard / Trackpad

Apple Inc. BRCM2070 Hub

Apple Inc. Bluetooth USB Host Controller

Thunderbolt Information: ⓘ

Apple Inc. thunderbolt_bus

Gatekeeper: ⓘ

Mac App Store and identified developers

Adware: ⓘ

~/Library/LaunchAgents/com.spigot.ApplicationManager.plist

One adware file found. [Remove]

Kernel Extensions: ⓘ

/Library/Application Support/Avast/components/fileshield/unsigned

[loaded] com.avast.AvastFileShield (3.0.0 - SDK 10.9 - 2016-09-23) [Support]

/Library/Application Support/Avast/components/proxy/unsigned

[loaded] com.avast.PacketForwarder (2.1 - SDK 10.11 - 2016-09-23) [Support]

/Library/Extensions

[not loaded] com_sony_driver_dsccamDeviceInfo00 (1.2.0.03040 - SDK 10.7 - 2016-09-19)

/System/Library/Extensions

[not loaded] com.Cycling74.driver.Soundflower (1.6.6 - SDK 10.6 - 2016-09-19) [Support]

[not loaded] com.marvell.kext.USBGenericPrinterClass (1.0.0 - 2016-09-19) [Support]

[not loaded] com.squirrels.airparrot.framebuffer (1.6 - SDK 10.8 - 2016-09-19) [Support]

[loaded] com.squirrels.driver.AirParrotSpeakers (1.8 - SDK 10.8 - 2016-09-19) [Support]

System Launch Agents: ⓘ

[not loaded] 8 Apple tasks

[loaded] 146 Apple tasks

[running] 72 Apple tasks

[killed] 12 Apple tasks

12 processes killed due to insufficient RAM

System Launch Daemons: ⓘ

[not loaded] 42 Apple tasks

[loaded] 147 Apple tasks

[running] 88 Apple tasks

[killed] 14 Apple tasks

14 processes killed due to insufficient RAM

Launch Agents: ⓘ

[not loaded] com.adobe.AAM.Updater-1.0.plist (2016-06-16) [Support]

[failed] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d.plist (2016-07-14) [Support]

[running] com.adobe.AdobeCreativeCloud.plist (2016-06-01) [Support]

[running] com.avast.secureline.update-agent.plist (2016-08-24) [Support]

[loaded] com.avast.secureline.userinit.plist (2016-08-24) [Support]

[running] com.avast.update-agent.plist (2016-09-24) [Support]

[loaded] com.avast.userinit.plist (2016-09-24) [Support]

[loaded] com.oracle.java.Java-Updater.plist (2014-01-23) [Support]

[running] com.sony.SonyAutoLauncher.agent.plist (2014-04-22) [Support]

[not loaded] com.splashtop.streamer-for-root.plist (2015-09-23) [Support]

[failed] com.splashtop.streamer-for-user.plist (2015-09-23) [Support]

[not loaded] com.teamviewer.teamviewer.plist (2012-04-06) [Support]

[not loaded] com.teamviewer.teamviewer_desktop.plist (2012-04-06) [Support]

Launch Daemons: ⓘ

[loaded] com.adobe.ARMDC.Communicator.plist (2016-07-14) [Support]

[loaded] com.adobe.ARMDC.SMJobBlessHelper.plist (2016-07-14) [Support]

[running] com.adobe.adobeupdatedaemon.plist (2016-06-16) [Support]

[running] com.adobe.agsservice.plist (2016-08-18) [Support]

[loaded] com.adobe.fpsaud.plist (2016-08-30) [Support]

[loaded] com.apple.installer.osmessagetracing.plist (2016-05-18)

[loaded] com.avast.init.plist (2016-09-24) [Support]

[loaded] com.avast.secureline.init.plist (2016-08-24) [Support]

[loaded] com.avast.secureline.uninstall.plist (2016-08-24) [Support]

[loaded] com.avast.secureline.update.plist (2016-08-24) [Support]

[loaded] com.avast.uninstall.plist (2016-09-24) [Support]

[loaded] com.avast.update.plist (2016-09-24) [Support]

[loaded] com.ea.origin.ESHelper.plist (2015-03-25) [Support]

[loaded] com.macpaw.CleanMyMac2.Agent.plist (2014-03-26) [Support]

[loaded] com.oracle.java.Helper-Tool.plist (2014-01-23) [Support]

[loaded] com.sharpcast.xfsmond.plist (2013-11-24) [Support]

[failed] com.splashtop.streamer-daemon.plist (2015-09-23) [Support]

[failed] com.splashtop.streamer-srioframebuffer.plist (2015-09-23) [Support]

[not loaded] com.teamviewer.teamviewer_service.plist (2012-04-06) [Support]

User Launch Agents: ⓘ

[loaded] com.adobe.AAM.Updater-1.0.plist (2016-06-02) [Support]

[failed] com.adobe.ARM.[...].plist (2012-04-20) [Support]

[not loaded] com.avast.home.userinit.plist (2016-09-24) [Support]

[loaded] com.avast.secureline.home.userinit.plist (2016-08-24) [Support]

[loaded] com.bittorrent.BitTorrent.plist (2015-12-06)

[loaded] com.bittorrent.uTorrent.plist (2016-05-18)

[loaded] com.google.keystone.agent.plist (2016-07-11) [Support]

[running] com.hp.printerAgent.plist (2012-09-05) [Support]

[not loaded] com.spigot.ApplicationManager.plist (2016-05-18) Adware! [Remove]

[failed] com.splashtop.streamer-for-user.plist (2016-01-05) [Support]

[loaded] com.spotify.webhelper.plist (2015-07-06) [Support]

[loaded] com.valvesoftware.steamclean.plist (2015-06-24) [Support]

User Login Items: ⓘ

iTunesHelper Application (/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

Google Drive Application (/Applications/Google Drive.app)

Internet Plug-ins: ⓘ

AdobeAAMDetect: 3.0.0.0 - SDK 10.9 (2016-06-16) [Support]

FlashPlayer-10.6: 23.0.0.162 - SDK 10.9 (2016-09-15) [Support]

QuickTime Plugin: 7.7.3 (2016-07-09)

AdobePDFViewerNPAPI: 15.017.20053 - SDK 10.11 (2016-08-07) [Support]

AdobePDFViewer: 15.017.20053 - SDK 10.11 (2016-08-07) [Support]

Flash Player: 23.0.0.162 - SDK 10.9 (2016-09-15) [Support]

Default Browser: 601 - SDK 10.11 (2016-07-09)

Flip4Mac WMV Plugin: 3.0.0.126 - SDK 10.8 (2012-12-28) [Support]

JavaAppletPlugin: Java 8 Update 91 build 14 (2016-04-21) Check version

Silverlight: 4.1.10329.0 (2012-08-04) [Support]

iPhotoPhotocast: 7.0 - SDK 10.8 (2013-04-21)

User internet Plug-ins: ⓘ

BlueStacks Install Detector: Unknown

Safari Extensions: ⓘ

Adblock Plus - Eyeo GmbH - https://adblockplus.org/ (2016-07-25)

avast! Online Security - AVAST Software - http://www.avast.com (2014-03-06)

3rd Party Preference Panes: ⓘ

Flash Player (2016-08-30) [Support]

Flip4Mac WMV (2012-09-15) [Support]

FUSE for OS X (OSXFUSE) (2013-11-24) [Support]

Java (2016-04-21) [Support]

Time Machine: ⓘ

Skip System Files: NO

Mobile backups: ON

Auto backup: YES

Volumes being backed up:

Macintosh HD: Disk size: 498.88 GB Disk used: 306.91 GB

Destinations:

My Book [Local]

Total size: 319.73 GB

Total number of backups: 0

Oldest backup: -

Last backup: -

Size of backup disk: Too small

Backup size 319.73 GB < (Disk used 306.91 GB X 3)

Top Processes by CPU: ⓘ

13% WindowServer

3% RdrCEF helper(11)

2% kernel_task

2% distnoted(2)

1% Adobe CEF Helper(3)

Top Processes by Memory: ⓘ

588 MB kernel_task

319 MB com.apple.WebKit.WebContent(14)

102 MB mdworker(11)

94 MB RdrCEF helper(11)

82 MB com.avast.daemon

Virtual Memory Information: ⓘ

64 MB Free RAM

3.94 GB Used RAM (710 MB Cached)

1.50 GB Swap Used

Diagnostics Information: ⓘ

Sep 28, 2016, 05:48:15 PM /Library/Logs/DiagnosticReports/ScreenSaverEngine_2016-09-28-174815_[redacted]. cpu_resource.diag [Details]

/System/Library/Frameworks/ScreenSaver.framework/Resources/ScreenSaverEngine.ap p/Contents/MacOS/ScreenSaverEngine

Sep 28, 2016, 01:49:00 PM /Library/Logs/DiagnosticReports/ScreenSaverEngine_2016-09-28-134900_[redacted]. cpu_resource.diag [Details]

Sep 28, 2016, 01:16:39 PM /Library/Logs/DiagnosticReports/ScreenSaverEngine_2016-09-28-131639_[redacted]. cpu_resource.diag [Details]

Sep 28, 2016, 12:32:51 PM /Library/Logs/DiagnosticReports/ScreenSaverEngine_2016-09-28-123251_[redacted]. cpu_resource.diag [Details]

Sep 28, 2016, 11:38:26 AM /Library/Logs/DiagnosticReports/ScreenSaverEngine_2016-09-28-113826_[redacted]. cpu_resource.diag [Details]

Sep 28, 2016, 10:45:08 AM /Library/Logs/DiagnosticReports/ScreenSaverEngine_2016-09-28-104508_[redacted]. cpu_resource.diag [Details]

Sep 27, 2016, 09:42:45 PM /Library/Logs/DiagnosticReports/ScreenSaverEngine_2016-09-27-214245_[redacted]. cpu_resource.diag [Details]

Sep 27, 2016, 12:55:27 PM /Library/Logs/DiagnosticReports/ScreenSaverEngine_2016-09-27-125527_[redacted]. cpu_resource.diag [Details]

Sep 26, 2016, 12:30:39 PM /Library/Logs/DiagnosticReports/ScreenSaverEngine_2016-09-26-123039_[redacted]. cpu_resource.diag [Details]

Sep 26, 2016, 12:08:25 PM /Library/Logs/DiagnosticReports/ScreenSaverEngine_2016-09-26-120825_[redacted]. cpu_resource.diag [Details]

Sep 26, 2016, 11:30:29 AM /Library/Logs/DiagnosticReports/ScreenSaverEngine_2016-09-26-113029_[redacted]. cpu_resource.diag [Details]

Sep 26, 2016, 09:12:55 AM ~/Library/Logs/DiagnosticReports/findNames_2016-09-26-091255_[redacted].crash

/System/Library/Services/AppleSpell.service/Contents/MacOS/findNames

Sep 19, 2016, 11:49:13 AM /Library/Logs/DiagnosticReports/Kernel_2016-09-19-114913_[redacted].panic [Details]

Reply

Answer 14

Eric Root

Level 10

684,027 points

Sep 28, 2016 10:36 AM in response to LibertyEnglish

None of the below is likely to cause the e-mail problems, but probably are affecting your computer operation.

You have adware installed. Run the report again and where you see the red Adware, click Remove. Once complete, run the report again and post a copy into a new reply.

Or download this program which was written by Thomas Reed, a long time poster. The program will do the work for you which makes it easy.

Malwarebytes Anti-Malware for Mac 10.8 and later

What should I do if Malwarebytes Anti-Malware for Mac didn't solve my problem?

Uninstall Avast. It tends to interfere with the computer's operation while providing minimal to no benefit.

Avast

Avast Un-install

Most people advise not to use cleaning programs.

CleanMyMac2 Un-install

After un-installing, use this program to make sure you got all the pieces.

EasyFind – Spotlight Replacement

Reply

Answer 15

Sep 28, 2016 11:39 AM in response to Eric Root

Hi again Eric

I've followed all your instructions and posted a new report below.

Some bulk emails went out from my account again this morning.....now I guess I'll wait a few days and see if the latest changes make any difference. It usually happens about a couple of times a week.

xx

EtreCheck version: 3.0.5 (309)

Report generated 2016-09-28 20:36:13

Download EtreCheck from https://etrecheck.com

Runtime 7:50

Performance: Below Average

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

Problem: Other problem

Hardware Information: ⓘ

MacBook Pro (13-inch, Late 2011)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Pro - model: MacBookPro8,1

1 2,4 GHz Intel Core i5 CPU: 2-core

4 GB RAM Upgradeable - [Instructions]

BANK 0/DIMM0

2 GB DDR3 1333 MHz ok

BANK 1/DIMM0

2 GB DDR3 1333 MHz ok

Bluetooth: Old - Handoff/Airdrop2 not supported

Wireless: en1: 802.11 a/b/g/n

Battery: Health = Normal - Cycle count = 1155

Video Information: ⓘ

Intel HD Graphics 3000

Color LCD 1280 x 800

System Software: ⓘ

OS X El Capitan 10.11.6 (15G1004) - Time since boot: about 9 days

Disk Information: ⓘ

ST9500325ASG disk0 : (500,11 GB) (Rotational)

EFI (disk0s1) <not mounted> : 210 MB

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

Macintosh HD (disk1) / : 498.88 GB (191.68 GB free)

Encrypted AES-XTS Unlocked

Core Storage: disk0s2 499.25 GB Online

OPTIARC DVD RW AD-5970H ()

USB Information: ⓘ

Hewlett-Packard HP Color LaserJet Pro M252dw

Apple Computer, Inc. IR Receiver

Apple Inc. FaceTime HD Camera (Built-in)

Apple Inc. Apple Internal Keyboard / Trackpad

Apple Inc. BRCM2070 Hub

Apple Inc. Bluetooth USB Host Controller

Thunderbolt Information: ⓘ

Apple Inc. thunderbolt_bus

Gatekeeper: ⓘ

Mac App Store and identified developers

Kernel Extensions: ⓘ

/Library/Extensions

[not loaded] com_sony_driver_dsccamDeviceInfo00 (1.2.0.03040 - SDK 10.7 - 2016-09-19)

/System/Library/Extensions

[not loaded] com.Cycling74.driver.Soundflower (1.6.6 - SDK 10.6 - 2016-09-19) [Support]

[not loaded] com.marvell.kext.USBGenericPrinterClass (1.0.0 - 2016-09-19) [Support]

[not loaded] com.squirrels.airparrot.framebuffer (1.6 - SDK 10.8 - 2016-09-19) [Support]

[loaded] com.squirrels.driver.AirParrotSpeakers (1.8 - SDK 10.8 - 2016-09-19) [Support]

System Launch Agents: ⓘ

[not loaded] 8 Apple tasks

[loaded] 145 Apple tasks

[running] 60 Apple tasks

[killed] 25 Apple tasks

25 processes killed due to insufficient RAM

System Launch Daemons: ⓘ

[not loaded] 42 Apple tasks

[loaded] 146 Apple tasks

[running] 84 Apple tasks

[killed] 19 Apple tasks

19 processes killed due to insufficient RAM