Hi All,

 

Needing to bounce something off of the community. 

I've never heard of a Notes address book virus, so I was quick to dismiss it as being the issue.  I've got one user with people calling him saying he is sending them spam.  Notably the receivers are receiving an email with the following format: (below link changed/modified for everyone's protection)

 

_____________________________

Dear <First Name Last Name>

New message, please read <http://webfactory123.webbandit.co.za/late.php?oy>

bill@myclientscompany.com

______________________________________________________________________

Facts:

• The names in the CC field are all alphabetical as if it's pulling from an address book
• Only about half of the names are found in that computer's Notes address book or in the recent contacts
• All names ARE found however in the user's inbox, in rough alphabetical order when sorting the inbox by name.
• Analyzing the email headers shows the email originated from a known spam server in Thailand, IP 125.26.159.150, ISP Tot, which is a known blacklisted source of spam
• There are no Domino server email transactions around the time from our user to any of the emails that were  received by these victims, so I don't think it's coming from the server, and even if it had, I think our MXLogic Spam gateway would have caught it, which showed nothing in quarantine.
• There  are no other outlook/webmail address books, or any other copy of address books...... only the Notes mail file and contact list, and Traveler on iPhone.
• Malwarebybtes reports clean on notes user's computer.
• AVG Cloudcare AV reports clean clean on notes user's computer.
• Spam reports seem to occur at 15-ish day intervals.....  two cycles now..... one mass spam event on Jan 14 and the other on Jan 30.

 

My thinking....

• I think something has grabbed a list of recipients from the notes user's inbox, and has transmitted that list to the spammer via trojan or virus, and then they are spoofing the Notes user's address from the Thailand spam server
• Perhaps there is a SMTP virus on the notes user's computer (so far not detectable) that sending via the Thailand server

 

Questions:

1. Has anyone heard of something like this affecting Notes?
2. Does anyone have any ideas on how to go about finding and preventing it?  Obviously if the list is already in and originating from Thailand, there's nothing to do.

Thanks for any ideas

Shane