Same emails downloaded over and over again

[madelynn4]

Has anybody out there ever had this problem or can you give me your opinion on what it could be caused from?

A problem of 100's of dupe emails, emails with the wrong time (off by hours), and blank emails (no sender or recipient) have been coming into our business for 5 weeks. We outsource our web/email hosting and all IT issues to an IT company who also outsources web/email hosting to an out of state company. The temporary fix I have been told is to delete the malicious email that is the root of the problems. This works for a couple of days then the dupes start flooding our email again.

The best way I can provide more info regarding this situation of ours is to show you (below) what our IT company says about it. Then I would like to ask anyone that can to enlighten me on whether this is a common problem and what I might do about it. Thank you in advance for your input-so appreciated!!

"The problem that you have been having, with your e-mail, is not an issue that can just be solved by us (your IT vendor). The issue is that when a malformed e-mail, that looks like it has an attachment (an invoice or a form or something similar), the e-mail client (Outlook, Outlook Express, Goldmine, etc.) has a problem downloading it. While trying to download that e-mail, it loses connection to the mail server and doesn't delete the e-mail you have already downloaded. The next time your computer tries to connect and download e-mail again, it downloads the same e-mails over again, loses connection when it hits that same e-mail, and fails. Our mail server is not creating duplicate e-mails. The reason that you are getting hundreds of e-mails in a matter of hours is because your e-mail client is setup to check e-mail every 60 seconds.
All that can be done is that the e-mail be filtered by the company that handles the SPAM and Virus filtering of e-mail. However, since the e-mail keeps changing, in style and content, it makes accomplishing this very difficult. This is not a virus issue on our server or your workstations. It is an issue of this malicious e-mail with this fake attachment. It's a new kind of issue, and every one is working to fix the problem.

 

[smah]

The description of the way mail gets downloaded & deleted from the server is basically correct, if somewhat simplified. However, the 'changing style....' business is a bunch of nonsense. Everyone gets some of these messages. It is not even always malicious; it could be just a malformed or damaged message.

If this happens infrequently, I wouldn't worry about it. But in your case, this seems to be a genuine problem. Start by increasing (slightly, don't be ridiculous) the timeout settings of your mail client. Also, what antivirus, antispam, and firewall software is being used on the client systems?

 

[madelynn4]

The antivirus is Symantic and the firewall is Cisco and
the antispam is thru Postini.

Can I increase the timeout settings of Goldmine (mail client) or do you mean the IT company we use should increase timeout settings someplace on their end. They monitor our firewall and susposedly all IT issues. I feel like I'm in the dard but realizing knowledge in this field is power.

I can go onto postini website and take it from extreme to moderate. Do you think I should do that?

 

[smah]

No, changing the Postini settings won't really make any difference. Postini is only an intermediate step that passes legitimate mail back to the mail server you're connecting to. Your client never actually connects to the Postini service. Try increasing the server timeout settings in your mail client. Is Goldmine the client software, or is it simply integrated with Outlook? (I didn't dig far enough into their web site to figure it out). Have you tried other mail clients?

 

[madelynn4]

If I'm understanding correctly, Goldmine is our mail client. It is the software we purchased for Contact Management which has email capabilities but email is not it's most desirable feature. The IT vendor we use installed, implemented and supports it. It can integrate with outlook but we don't use it that way yet. When we push "get mail", it get's the mail from the site of the outsourced vendor that our IT vendor uses.

We put an email address on a different computer and used Outlook for a test but after a day it would not connect to the server anymore.

Tomorrow while in the office I can do as you suggested and try to find the timeout settings in Goldmine to increase them. If this is something I can do at my PC at work. Our server is hosted offsite by an IT vendor so I'm not sure yet what my limitations are. Goldmine is installed in most of our PC's and I can login as administrator-so that may be the route I take.

I wonder if signing a 3 year contract to have a vendor take all of our IT worries is possibly the worst business decision I made in 2005.

 

[paulha]

Potentially ;-)

Is the firewall Cisco Pix, if so, what version of software is it running ?

 

[madelynn4]

Yes it is. I looked through files in the server but couldn't find the software info. would it be under a name besides cisco? Can you tell me how to find the version from my station?

 

[paulha]

If your pix has a web interface, you can log on and do a help & about. If there is only a console interface, I am not too sure, but the Pix forum should be able to tell you in next to no time

http://www.tek-tips.com/threadminder.cfm?pid=35,

alternatively cisco.com

There is a known problem with some versions of the firewall software causing multiple emails, somewhere along the lines of what you IT company alluded to in your first post

http://archives.neohapsis.com/archives/postfix/2001-01/1808.html

http://www.tek-tips.com/viewthread.cfm?qid=728659&page=2

It may be worth your while getting your IT company to look at the above two references, and have them eliminate the possibility that this could be causing your problem.

Good luck

Paul

 

[madelynn4]

I'm looking into this today between the thousands of tasks on my to do list.

Question: What is your take on the emails that come in with the wrong time stamp. The time is off by hours. Twice it was a whole day ahead.

 

[madelynn4]

I was unable to get my username and password to my firewall from the IT vendor we use but they looked up the software version for our cisco pix firewall 5.06E and it is version 622.

Does this point to the firewall being the problem?

 

[paulha]

6.22 looks to be fine. Back to the drawing board then.

Not sure about the timestamp issue, I'll see what I can find