Editore"s Note
Tilting at Windmills

Email Newsletter icon, E-mail Newsletter icon, Email List icon, E-mail List icon Sign up for Free News & Updates

June 17, 2007
By: Kevin Drum

EMAIL QUESTION....I turn to the hivemind of the blogosphere for help. I have a weird email problem.

This morning, for the third time in a week, my email client (Thunderbird 2.0) was filled with identical pieces of spam. Same text, same sender, same timestamp. They pop into my inbox about once every ten minutes.

The first time this happened I thought I was the victim of some moronic spammer who had decided to send me a thousand copies of the exact same message. But then it happened again. And then a third time. Different spammers each time. And when I check my webmail interface, there's only one copy of the email.

So it looks like the fault is Thunderbird's. Every once in a while, it goes crazy and starts creating copies of emails. I've now figured out that if I go into the webmail interface and remove the offending email from the server and delete all the copies in my inbox and empty the trash, the spawning cycle stops. But I'm still curious about what's going on. Anyone have any ideas?

Kevin Drum 12:28 PM Permalink | Trackbacks | Comments (36)

Bookmark and Share
 
Comments

Uh, make a purchase KD and the spamming will end. We are all powerful. The only thing you can do to is given in to us...get the credit card out my friend

Posted by: Mr Spam on June 17, 2007 at 12:45 PM | PERMALINK

Uh, make a purchase KD and the spamming will end. We are all powerful. The only thing you can do to is give into us...get the credit card out my friend

Posted by: Mr Spam on June 17, 2007 at 12:46 PM | PERMALINK

Well, it sounds like TB is failing to delete that message from the server for some reason, leading to it downloading it over and over. Perhaps something in the message causes a crash somewhere which prevents it from getting to the code that deletes messages.

-- Help is on the way

Posted by: TLB on June 17, 2007 at 12:48 PM | PERMALINK

I had that problem with an email from a business associate a few weeks ago. My best guess is that the mail server for that email address (sbcglobal.yahoo.net) was messed up.

Colin

Posted by: Colin on June 17, 2007 at 12:48 PM | PERMALINK

are you using pop3 with leave on server, or imap?

If you are using pop3, my suggestion would be to switch to imap. If you are using imap.....well, um....look a shiney! *runs away*

Posted by: a cornellian on June 17, 2007 at 12:49 PM | PERMALINK

Who is your ISP?

Posted by: NealB on June 17, 2007 at 12:57 PM | PERMALINK

maybe a bug in one of your filter settings, i.e. somehow a filter is forwarding the mail to you under some unusual condition (this might explain the time lag)?

or is the 10 minutes the interval you have TB set to check your email on the server, in which case is the mail not getting deleted from the server? do you have it checking multiple servers?

Posted by: supersaurus on June 17, 2007 at 1:03 PM | PERMALINK

You might want to set your mail to text only, and no previews etc. It is possible that there may be something in a link in the mail that is causing the replication. Not all the malicious or spamming code written necessarily works as intended.

You might want to look at your sent/out folders to see if the mailer is sending it. Also check for any running processes that are not explainable. One trick sometimes to finding stealth processes is to either unplug the network cable (often will cause the process to consume high CPU) or use a firewall to block outbound port 80 and possibly outbound port 25 to see if you are getting activity. (Obviously, you do this temporarily)

I remember there used to be a class of email viruses that did an auto reply to each email you received.

When looking at email, remember the "from" on the email can be completely meaningless, as mailers don't care about source of mail, only the destination. You have to look at the headers for the real info.

Posted by: RickG on June 17, 2007 at 1:27 PM | PERMALINK

I have similar problems with thunderbird. My situation occurs somewhat randomly with RSS feeds in the newsreader portion of the app (tho not all the feeds do this). Duplicate entries...in the lesser read blogs, i get sometimes as many as 10 duplicates of hundreds of messages over time before I catch it.

Posted by: sunship on June 17, 2007 at 1:30 PM | PERMALINK

Perhaps a bug in Thunderbird or, because it is sadly likely that you are using windows, it is a simple built-in flaw in windows. A scripting vulnerability, perhaps, spawning more messages.

Switch to linux (and still use thunderbird if you wish) and see if it still happens. Go with one of the test-drive variants on a CD or USB stick - no install but you can boot up a real linux distro and setup whatever the f*ck you want. If the problem remains, it is thunderthighs, if it goes away it is windows.

Posted by: Praedor Atrebates on June 17, 2007 at 1:43 PM | PERMALINK

I had the same problem as you're describing. There's a plug-in (sorry, extension, or add on, or whatever) available to delete duplicate messages. You have to click some buttons each time to kill the dupe messages, but it generally worked as was easier than what you're doing.

Oddly enough, after I installed the plug in the problem went away, and I'm not sure the plug in had the functionality to make it stop on its own.

(I think it's just called Remove Duplicate Messages, put it should be easy enough to find.)

Posted by: boatshoes on June 17, 2007 at 2:04 PM | PERMALINK

Check that you are not looping your email by forwarding. Perhaps you are saving a copy to another email address, which is in turn forwarding it back to the original address. The ten minute thing is probably the Thunderbird "check for new email" timer.

Posted by: bebimbob on June 17, 2007 at 2:04 PM | PERMALINK

Are you sure you weren't drinking Thunderbird, Kevin???

Me, I prefer Mad Dog 20/20.

Posted by: Joe Bob Briggs on June 17, 2007 at 2:24 PM | PERMALINK

Eudora.

Posted by: Rula Lenska on June 17, 2007 at 2:28 PM | PERMALINK

Mailwasher

Posted by: Tim on June 17, 2007 at 2:34 PM | PERMALINK

I use Thunderbird on the Mac and at least two different times it has insisted on redownloading all the mail that I still had on the server. So I ended up with duplicates of all the email that was still on my server. So I think there is an intermittent bug there.

Posted by: Steve Read on June 17, 2007 at 2:36 PM | PERMALINK

It could be a problem with the NEXT email item in queue on your server, assuming you are downloading to Thunderbird by POP. The next one could be too damn big or full of junk. So T-Bird POP downloads until it hits the one it can't get, then it stops and starts over, because it doesn't think it has finished the session. It restarts, restarts, restarts, and will till you go onto the server and delete that next mail (... which is probably a movie review from Joe Bob with his list of garganzolas attached!!)

Posted by: JohnHenryCouldHammer on June 17, 2007 at 2:40 PM | PERMALINK

Ops: 712 32 ECHELON PROGRAM 943A-4 GO

Posted by: Ops on June 17, 2007 at 3:40 PM | PERMALINK

OE.

Posted by: Brian on June 17, 2007 at 3:59 PM | PERMALINK

Possible corrupt mbox file on the mail server, in which case there's not much you can do on your end in the short term except download all mail and delete it off the server. In the long term you might start using the mail download option that deletes mail off the server rather than keeping old mail around for n days (I don't know how to set this option in Thunderbird but I assume there is one).

Posted by: Jamie McCarthy on June 17, 2007 at 4:14 PM | PERMALINK

I second the "failing to delete message from server" suggestion. I had that problem with Apple Mail for a time -- every so often, I'd get dupes of every single message.

Posted by: filosofickle on June 17, 2007 at 5:24 PM | PERMALINK

If the email is replicating itself only with spam e-mail, it's possible there's some kind of script running within the mail itself, telling the email client to keep downloading the mail from the server (with the idea of this somehow forcing you to read the pitch). Archive a copy and send it to a friend who some programming experience.

Or it could just be bad code in Thunderbird being exploited. Who knows how many different servers spammers bounce their garbage off of?

Posted by: Old Hat on June 17, 2007 at 7:29 PM | PERMALINK

What is your root password?

Posted by: absent observer on June 17, 2007 at 8:22 PM | PERMALINK

My password is "hello".

Why?

Posted by: Kevin Drum on June 17, 2007 at 11:34 PM | PERMALINK

I believe I've had this happen to me when someone sends me an email that's postdated AND I am not deleting mail from the server.

Posted by: G. Jones on June 18, 2007 at 12:47 AM | PERMALINK

No doubt Kevin has Googled this, and has discovered that others have reported the same problem -- but it seems not to be a widespread one.

One university FAQ says this:

Why do I get multiple copies of the same message when I check email through programs like Thunderbird and Outlook?

This is a problem with using the POP protocol. Your mail program forgets which messages it has downloaded, so it downloads the same ones again. The way to make this stop happening is to stop leaving messages on server (a setting in your mail program) or preferably, to stop using POP.

Others have suggested that the presence of a huge mail file on the server can cause the onset of this problem.

Posted by: JS on June 18, 2007 at 1:43 AM | PERMALINK

I've had this problem, and I figured out that checking through the webmail interface was what triggered it. I don't check through the webmail interface anymore and it hasn't happened since.

As others have suggested, if you make sure your e-mail client doesn't leave messages on the server after retrieving them, you won't have this problem.

Posted by: Tony on June 18, 2007 at 9:39 AM | PERMALINK

I've been happy with a quirky (and not free) mailreader called "The Bat!" from Eastern Europe.

Posted by: Andrew J. Lazarus on June 18, 2007 at 10:48 AM | PERMALINK

Since it happens with a spam message, here's my theory:

The spammer has figured out how to corrupt the internals of the message, so that when your mail client send a request the mail server to delete the message so-and-so (with a corrupted identifying string) the mail server can't do it. However, when you use the web interface, which operates a bit differently, you can select and delete the message that way.

Posted by: bob on June 18, 2007 at 11:28 AM | PERMALINK

I've had something like this happen to me with Thunderbird. And when I delete one of the duplicate e-mails, the subject and sender of remaining duplicate suddenly turn blank.

The problem can be fixed by closing Thunderbird, deleting the Inbox.msf file, then re-opening Thunderbird. Depending on the amount of mail in the inbox, it can take a couple of minutes for Thunderbird to re-build the mail database.

Posted by: Ballard Fremont Edmonds on June 18, 2007 at 12:11 PM | PERMALINK

There used to be a similar problem on the Political Animal blog itself where nearly identical comments written by a fellow named "Charlie" would mysteriously show up multiple times under different names.

Posted by: Qwerty on June 18, 2007 at 1:39 PM | PERMALINK

First empty the trash folder: Right click on folder.
Then compact inbox: Right click on folder.
Then do the above suggestion to delete the Inbox.msf

If the above fails, disconnect from the internet. In Tunderbird create a new folder called create backup_inbox, and move all messages from inbox to backup inbox so that inbox is empty.

Then do the three steps above again, empty trash, compact inbox, delete Inbox.msf and then compact again.

Now your system is clean...
Set the option to delte after download, and NOT to leave messages on the server (for x days).

Reconnect to internet and let Thunderbird re-import all the older mail still on the server and then disconnet from the internet.

MOVE any NEW messages that have come in since you started this to the backup inbox. (They will all look new so check dates and times.)

The rest are all dupes so delete everything left in the inbox. Compact inbox.

Reset the 'leave mail on the server for x days option back to your choice'.

Reconnect and check that only new messages are comming in to your clean email box. (You may have to send your self a test message.)

Now, if you wish, you can move the archived older inbox messages from your 'backup_inbox' folder to the real inbox folder. (You may want to delete any dupes, spam and messges with large attachemnts first before moving the rest back.)

This should both sort out your inbox and clear all the old messages from the server.

Posted by: J Musters on June 18, 2007 at 11:30 PM | PERMALINK

First empty the trash folder: Right click on folder.
Then compact inbox: Right click on folder.
Then do the above suggestion to delete the Inbox.msf

If the above fails, disconnect from the internet. In Tunderbird create a new folder called create backup_inbox, and move all messages from inbox to backup inbox so that inbox is empty.

Then do the three steps above again, empty trash, compact inbox, delete Inbox.msf and then compact again.

Now your system is clean...
Set the option to delte after download, and NOT to leave messages on the server (for x days).

Reconnect to internet and let Thunderbird re-import all the older mail still on the server and then disconnet from the internet.

MOVE any NEW messages that have come in since you started this to the backup inbox. (They will all look new so check dates and times.)

The rest are all dupes so delete everything left in the inbox. Compact inbox.

Reset the 'leave mail on the server for x days option back to your choice'.

Reconnect and check that only new messages are comming in to your clean email box. (You may have to send your self a test message.)

Now, if you wish, you can move the archived older inbox messages from your 'backup_inbox' folder to the real inbox folder. (You may want to delete any dupes, spam and messges with large attachemnts first before moving the rest back.)

This should both sort out your inbox and clear all the old messages from the server.

Posted by: J Musters on June 18, 2007 at 11:30 PM | PERMALINK

Hi guys. It's never just a game when you're winning. Help me! Could you help me find sites on the: Aloha baby crib bedding. I found only this - baby bed sets. This pace has proposed and has been stranded oily timings by a rough game of pieces, bedding. Bedding, how to grow a widely bad chemical to evaluate the target of your album without looking security. With love :mad:, Rasia from Palau.

Posted by: Rasia on March 10, 2010 at 5:09 AM | PERMALINK

Looking where to buy actigall online? No problem!buy actigall without prescription

Posted by: Buy actigall online on September 28, 2010 at 11:09 AM | PERMALINK

When will it end?
All of this "get a free wii" spamming. do your part and mark it as spam each and every time.
map

Posted by: Morton on October 23, 2010 at 9:44 AM | PERMALINK




 

 

Read Jonathan Rowe remembrance and articles
Email Newsletter icon, E-mail Newsletter icon, Email List icon, E-mail List icon Sign up for Free News & Updates

Advertise in WM



buy from Amazon and
support the Monthly