Author Topic: Dick, your mailbox is full (Read 3052 times)

krissel · « **on:** February 05, 2009, 01:07:10 AM »

Have been getting rejected TS subscription emails from your Earthlink address past couple days.

"User account is overquota"

Xairbusdriver · « **Reply #1 on:** February 05, 2009, 10:23:24 AM »

One of those may have been because I sent him a PM about it? Got them from direct emails a few days ago, also. But I think he has either cleaned house or it may have been an ISP foulup...

Maybe we should just call him, he seems to be very 'close' to that iPhone!

Paddy · « **Reply #2 on:** February 05, 2009, 10:51:01 AM »

Still getting them this morning, Jim, with a few threads he's subscribed to. The email notification from TS bounces.

Xairbusdriver · « **Reply #3 on:** February 05, 2009, 12:45:41 PM »

He may be later to explain further but it appears a friend of his, using a Windows machine, of course, had his address book stolen/borrowed. The 'collector' or the malware then sent emails with dozens of large pictures to everyone in the list, many multiples of times. 3+MB messages each time. Eventually, that filled up many recipients mailbox, even if they tried to shred many of the messages as they came in...

Another good reason to ask PC users to not include your name in the "To:" or "CC:" part of any emails that they send. And, of course, another chance to suggest a 'think different' attitude!.

RHPConsult · « **Reply #4 on:** February 05, 2009, 04:13:05 PM »

The problem was, but no longer is, as ABD has recounted. Thank you Mr. Balmer.

I received from an USAF vet, and long-time pal, around 75 e-messages (presumably) carrying pics of military aircraft, @ 3+ MB ea. They arrived in several "squadons", each of several "flights", so I had to effect repeated "therapeutic" measures with my WedMail over 36 hours. The dispatcher of these missives/missles was unaware of what was happening until he returned home from a journey and found his own mailbox filled with bounced messages (100a and 100s he told me) from many (former) friends' adressses, whose mailboxes were already filled with the previous "attacks" so generously enabled by his Dell/Vista/M$M devices.

He then told me of the "mess" that is Vista and the "changing MS policies" that have fewer protections for his computer against spam, etc. etc. etc.

I offered (gave) him a gentle (genteel) lecture on why he should become a Mac-ster, despite his misguided self-concept of being quite technically savvy – which in fact he is – and why he will probably be a victim again, unless he changes his ways.

I've already sent him the URL for the Apple Store. We're going to talk again when the new iMacs appear.

We may just have a switcher in the making!

Xairbusdriver · « **Reply #5 on:** February 05, 2009, 04:50:12 PM »

If he'd had a Mac, those addresses would not have been stolen or his machine loaded with the malware that sent them. OTOH, using a Mac doesn't prevent these scum-bags from sending the massive emails to us! At least as long as there are Windows users who have our addresses...

RHPConsult · « **Reply #6 on:** February 05, 2009, 06:46:38 PM »

Uh Ih!

My Inbox is continuing to receive the HUGE virus-infected mail from my wayward Vists/Dell/M$M pal nopt arriving in bunches of fifteen + 3.5 MB items.

Does anyone know if Apple MAIL has a setting somewhere that instructs the server to trash any mail that has been delected by hy computer? I believe SeaMonkey will do that. Earthlink's servers only have a time limit before trashing.

Does anyone know how I can block his address from my Inbox?

Does anyone know Windows well enough to know what to say to him to cleanse his computer? Other than knock this %$&^*(?}+{ off?

I don't understand why he can't get advice from somewhere about this increasingly vexing mess.

Paddy · « **Reply #7 on:** February 05, 2009, 06:53:42 PM »

Dick, are you using POP or IMAP? Because if you're using IMAP, you can simply make a rule to automatically delete all mail from this sender upon receipt, and the email will be deleted off the server as well. If you're using POP, set Mail to delete mail off the server when you download it (at least until he has the problem solved!) and use the Mail rule:

To delete all mail from a certain sender automatically in Mac OS X Mail, set up a new message rule:

Select Mail | Preferences... from the menu in Mac OS X Mail.
Go to the Rules tab.
Click Add Rule.
Make the criterion read From Contains.
Insert the email address of the person you want to block.
From the actions, select Delete message.
Assign a Description to the new rule.
Close the dialog with OK.

Unfortunately I don't think there is any way you can get the mail bounced from the server to begin with unless Earthlink can do something on their end. I'm surprised the payload is getting through - a good spam blocker generally will recognize a virus when it sees it.

RHPConsult · « **Reply #8 on:** February 05, 2009, 07:27:33 PM »

I am very, very, very grateful to you, Paddy.

In all my years I have only had something "viral" befall me but once.

1988, I picked up a virus on a floppy when printing some files at a Kinko's in Honolulu, which subsequently didn't do my SE any good.

Throughout all the intervening years I've only been a curious bystander, never having to write a rule, let alone find where such "writing" is accomplished.

Found both places a few minutes ago, both in MAIL and on my iMac (Earthlink is a POP account) thus it would appear I'm safe . . . for now. Thanks to you!

Xairbusdriver · « **Reply #9 on:** February 05, 2009, 09:11:18 PM »

You might not want to have a blanket rule that deletes/trashes everything from that guy IF there is any common identifying aspects of the SPAM. If so, just modify the rule to look for that specific "trait" before dumping it. The "trait" can be almost anywhere in the messages, not just the "From:", of course. You can even make multiple items that all need to be in a message before it is dumped. There are actually 26 different things in several different places that can be looked at and most of them allow you to enter specific words to look for in that place. And you can have as many rules for any address you want, just click the little "+" button to add another specific thing to have Mail look for.

And don't forget to tell Mail what to actually do when it finds a message that fits one of your rules...probably "Delete message."

RHPConsult · « **Reply #10 on:** February 07, 2009, 01:30:24 AM »

QUOTE(Xairbusdriver @ Feb 5 2009, 07:11 PM) <{POST_SNAPBACK}>

You might not want to have a blanket rule that deletes/trashes everything . . .

So here's what I learned in my first foray into Rules.

It surely does "trash everything", in fact it shut down any/every e-mail because I failed to read the full implications of the dropdown choices I made.

So it stopped every e-mail that has, anywhere it its From panel a:

(my friends e-mail name) that's good
the "@" symbol – uh oh
a (.) i.e. dot – double uh oh
the com suffix

and that just about takes care of anything you might imagine.

It didn't take too long

to figger-out I maybe, just maybe, had been a little broad in rule-making.

So I shrunk it down to include only my friend's screen name,

AOK now.

Live and learn

with more than little help from my friends

krissel · « **Reply #11 on:** February 07, 2009, 02:13:33 AM »

Xairbusdriver · « **Reply #12 on:** February 07, 2009, 09:55:54 AM »

Does that "screen name" only on the very large messages 'he' sends? If so, that should work fine, ignore the remainder of this post. However, you cannot pass Go nor collect $200. Sorry.

However, if he sends you a legitimate message and it has that screen name, you'll never see it. That may or may not be what you want.

The great thing about most 'rules' functions is that you can get very specific about what the rule applies to. Personally, I'd disable the rule for a period of time and actually download at least two of the large messages. You can then re-enable the rule and block/delete whatever it blocks/deletes.

You can now view the two (or more) messages and look for anything that might be common to them but is not in what you would call one of his 'normal' messages. If you find something (and it would be good to look at the message source) that is 'special' and common to only the SPAM messages, change the rule to search/look for that term. Otherwise, you may be "throwing the baby out with the bath water!"

Sasha · « **Reply #13 on:** February 07, 2009, 10:25:16 PM »

"Screen name" and "any attachment name" oughtta do it.

RHPConsult · « **Reply #14 on:** February 08, 2009, 04:31:57 PM »

My erstwhile pal called to tell me that Dell told him Friday that it's not a virus but some kind of perverse (my term) and selective interactions between PowerPoint and "some" computers that's producing the neurotic circularity (as I don't understand it). Huh?

Descriptions (as opposed to explanations) are the last bastion of knaves!

I know, I know. "It's a feature".

Thanks for everyone's help. No problem now for about 60 hours.

News:

Author Topic: Dick, your mailbox is full (Read 3052 times)