# Bounce messages for emails I never sent **URL:** \ **Category:** Factual Questions\ **Created:** [May 9, 2002, 4:02pm UTC](https://boards.straightdope.com/t/bounce-messages-for-emails-i-never-sent/108105 "2002-05-09T16:02:41Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![CookingWithGas](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cookingwithgas/32/485_2.png) [@CookingWithGas](https://boards.straightdope.com/u/CookingWithGas)\ **Post date:** [May 9, 2002, 4:02pm UTC](https://boards.straightdope.com/t/bounce-messages-for-emails-i-never-sent/108105/1 "2002-05-09T16:02:41Z")
Once in a while I get a spate of various types of bounce messages (usually from System Adminstrator, indicating the addressee is unknown), which refer to a message I never sent. The message is always some kind of spam advertising. I notified my ISP but they sent me a canned answer saying to check for viruses. No virus on my system, according to Norton, and none of the bounce messages are from email addresses in my address book or that I recognize. I suspect that someone is spoofing my email address to send spam. Unfortunately the bounce messages do not include the full header for the message they received. Any other possibilities I’m overlooking here? ---
**Author:** ![Johnny\_L.A](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnny_l.a/32/1084_2.png) [@Johnny\_L.A](https://boards.straightdope.com/u/Johnny_L.A)\ **Post date:** [May 9, 2002, 4:07pm UTC](https://boards.straightdope.com/t/bounce-messages-for-emails-i-never-sent/108105/2 "2002-05-09T16:07:54Z")
[Is this what your problem is?](http://vil.nai.com/vil/content/v_99367.htm) ---
**Author:** ![Joe\_Cool](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@Joe\_Cool](https://boards.straightdope.com/u/Joe_Cool)\ **Post date:** [May 9, 2002, 8:02pm UTC](https://boards.straightdope.com/t/bounce-messages-for-emails-i-never-sent/108105/3 "2002-05-09T20:02:35Z")
> [@](#): > > \*Originally posted by Johnny L.A. \* > \*\*[Is this what your problem is?](http://vil.nai.com/vil/content/v_99367.htm) \*\* Betcha a dollar that’s exactly it. ---
**Author:** ![CookingWithGas](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cookingwithgas/32/485_2.png) [@CookingWithGas](https://boards.straightdope.com/u/CookingWithGas)\ **Post date:** [May 9, 2002, 9:03pm UTC](https://boards.straightdope.com/t/bounce-messages-for-emails-i-never-sent/108105/4 "2002-05-09T21:03:55Z")
I can’t rule it out but I don’t have most of the symptoms. Since I have Norton I’ll follow their instructions for removal, and if I remember I’ll let you know tonight/tomorrow. Thanks. ---
**Author:** ![buckgully](https://avatars.discourse-cdn.com/v4/letter/b/eb9ed0/32.png) [@buckgully](https://boards.straightdope.com/u/buckgully)\ **Post date:** [May 9, 2002, 9:12pm UTC](https://boards.straightdope.com/t/bounce-messages-for-emails-i-never-sent/108105/5 "2002-05-09T21:12:53Z")
I’m having this problem too, and it is Klez. However, it’s not my system that was infected (I’m running Linux), it was a friend’s system. Klez uses addresses picked out of the infected machine’s addressbook for its from header. ---
**Author:** ![Larry\_Mudd](https://avatars.discourse-cdn.com/v4/letter/l/f14d63/32.png) [@Larry\_Mudd](https://boards.straightdope.com/u/Larry_Mudd)\ **Post date:** [May 9, 2002, 9:38pm UTC](https://boards.straightdope.com/t/bounce-messages-for-emails-i-never-sent/108105/6 "2002-05-09T21:38:35Z")
> [@](#): > > \*Originally posted by buckgully \* > \*\*Klez uses addresses picked out of the infected machine’s addressbook for its from header. \*\* Ahh. I was puzzled when I received a spate of returned (unsent) mail last week, checked to see what viruses where jumping around, pegged it as likely Klez, downloaded Symantec’s Klez removal tool and ran it, and found that I was clean. (I’m very fastidious about virus protection.) Thanks for that info, I’ll send a link to the removal tool to everyone in my contact list. ---
**Author:** ![Futile\_Gesture](https://avatars.discourse-cdn.com/v4/letter/f/f05b48/32.png) [@Futile\_Gesture](https://boards.straightdope.com/u/Futile_Gesture)\ **Post date:** [May 10, 2002, 4:28pm UTC](https://boards.straightdope.com/t/bounce-messages-for-emails-i-never-sent/108105/7 "2002-05-10T16:28:34Z")
> [@](#): > > \*Originally posted by Larry Mudd \* > \*\* > > Ahh. I was puzzled when I received a spate of returned (unsent) mail last week, checked to see what viruses where jumping around, pegged it as likely Klez, downloaded Symantec’s Klez removal tool and ran it, and found that I was clean. > > (I’m very fastidious about virus protection.) > > Thanks for that info, I’ll send a link to the removal tool to everyone in my contact list. \*\* It’s not your system that has the virus. It sends itself from other’s computers using your address (randomly lifted from their Outlook) as the Reply to: header. If you’re going to send out a link to people you need to be aware that Klez also sends out copies of itself pretending to be an anti-viral cure for itself. So personalise your email to make sure it doesn’t look like this. I’m getting about 5 of these a day just now. :mad: Plus the occasional bounce. ---
**Author:** ![Visual\_Purple](https://avatars.discourse-cdn.com/v4/letter/v/5daacb/32.png) [@Visual\_Purple](https://boards.straightdope.com/u/Visual_Purple)\ **Post date:** [May 10, 2002, 5:11pm UTC](https://boards.straightdope.com/t/bounce-messages-for-emails-i-never-sent/108105/8 "2002-05-10T17:11:43Z")
I don’t think Klez is the only possible cause out there. This Tuesday morning I found a standard “spy on anyone from your computer” type spam in my in-box – with a reply-to of my own e-mail address! At the same time, I also received about fifteen bounce notifications that indicated that the message had been the same piece of spam. In this case, I think its pretty obvious that my address was “borrowed” for spamming. I am wondering if this is what happened to CooksWithGas. No suggestions on how to deal with this. In fact, advice would be appreciated.