Windows 10: Windows 10 Mail App Sends Mails Without My Permission

I don't have them anymore, was afraid of infection. From my Mail Service Provider Webmail Access i can see header. I need to wait another attack to have a mail in my hands to look in.

 

Check it for me guys. If you need to remove something, feel free to do it.

Return-Path: REMOVED
Delivered-To: REMOVED
Received: (qmail 9529 invoked by uid 89); 8 Nov 2015 06:24:09 -0000
Received: from unknown (HELO mxcmd05.ad.aruba.it) (10.10.10.72)
by mxavas1.ad.aruba.it with SMTP; 8 Nov 2015 06:24:09 -0000
Received: from smtp4.ngi.it ([88.149.128.21])
by mxcmd05.ad.aruba.it with bizsmtp
id euQ91r03h0Tq7sw01uQ9fV; Sun, 08 Nov 2015 07:24:10 +0100
Received: from WIN-NPPN1JPV75J (unknown [86.35.218.6])
by smtp4.ngi.it (Postfix) with ESMTPA id DC9CA80F67;
Sun, 8 Nov 2015 07:24:08 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=ngi.it; s=dkim;
t=1446963850; bh=5oN2SRwNoEcpkO6Evt2NfYgPh49+GPz+A152plXm90s=;
h=From:To:Subject:date:From;
b=eJbfdz4RqIB/7xVi1Kaw9TLfNLHIO2pPu55Xu6gWwE3gngjn6PT1QsmyvkiiIL9R0
SRKAqJEcdwHMm4hhfRpHp7NKxsbFUnQPJ1xPcWZdMu3apszYdmyC8Kydq+70ZJc0m/
qBR9QeE5oZJrJ9heo+IYwSJ08MQyPTjMFIHOTdYI=
From: REMOVED
To: REMOVED
Subject: Fw: new message
Date: Sat, 7 Nov 2015 22:24:01 -0800
Message-ID: <00007457f75b$96268be1$aabc411c$@ngi.it>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_205CBCA1.641EF527"
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AdEmDynrtB1rOLeCMrdN6se3es3s6A==
Content-Language: en-us
X-Antivirus: avast! (VPS 151107-0, 11/07/2015), Outbound message
X-Antivirus-Status: Clean
X-Spam-Rating: mxavas1.ad.aruba.it 1.6.2 0/1000/N
X-Antivirus: AVG for E-mail 2016.0.7227 [4457/10966]
X-AVG-ID: ID3A8231C2-5D0BD32A

 

mxcmd05.ad.aruba.it isn't you presumably.

 

I have seen a mail sent by mine. There are internal and external ip address of my network. WIN-NPPN1JPV75J is the sender, a botnet, there's a page about it on google.

 

If you mean this Google Groups I just saw it.

There are others like this Orario posta in arrivo sbagliato asking why the spam filters are not picking it up (I don't understand much Italian though).

Gmail should filter mail like this - I see things in Spam now I look. Was it the contacts with the non-gmail accounts that were complaining? (Well done for removing them btw).

 

I have @ngi, not @gmail. The page i am talking about is this.

New Threat: The WIN-NPPN1JPV75J Botnet

 

How can i protect my contacts from these emails? I don't know third party software to solve the problem or how to set spf records on my DNS.

 

They aren't being sent by you so nothing you do on your PC will make any difference. As you said the last lot were sent when your PC was turned off.

As far as I know you can't do anything except warn your contacts. The thing is their spam filters should pick up these messages.

 

My ISP can't do nothing.

 

It's nothing to do with your ISP - the email address is probably being spoofed in which case where is nothing you can do

 

No because they are being sent from someone in Romania *Sad

 

This is the mail system at host ubscode.com.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The mail system

<removed>: delivery temporarily suspended: host
mx.libero.it[212.48.24.20] refused to talk to me: 550 smtp-02.iol.local
bizsmtp IP blacklisted by CSI. For remediation please use
CSI IP Reputation Remediation Portal
[smtp-02.iol.local; LIB_102]

<removed>: delivery temporarily suspended: host
mx.libero.it[212.48.24.20] refused to talk to me: 550 smtp-02.iol.local
bizsmtp IP blacklisted by CSI. For remediation please use
CSI IP Reputation Remediation Portal
[smtp-02.iol.local; LIB_102]

<removed>: delivery temporarily suspended: host
etb-4.mail.tiscali.it[213.205.33.63] refused to talk to me: 554
imp-1.mail.tiscali.it fuWn1r00F3V8EwX01 IP: 31.193.141.161, You are not
allowed to send mail. Please see
CSI IP Reputation Remediation Portal if you feel this
is in error.

I received 5 mails like this.Thanks to god, my account didn't sent these messages, but why? What's blocked the botnet? I need an explanation.

 

It looks like your contacts ISPs use cloudnet and it has blacklisted the senders IP (86.35.218.6) as suspect. As the "Sent from" is your email address they send you an email saying they will not accept the mail.

This is a good thing - your contacts don't get the spam. Only if you were getting these when you sent the mail would it be a problem.