I'm a system administrator at a small university with about 150 full time staff.

In the past week, I've had two clients report that they're not getting any emails. On examination, we find that they are getting messages, but the messages are moved immediately to the trash. Both users are using Outlook 2010 connected to our exchange server. They may occasionally use OWA when accessing remotely.

We examined their message rules and found a rule entitled "delete it". The rule says

After the message arrives
Move it to the trash

Makes sense!

Finding this on one user's computer looked like a foolish user move (experimenting with rules) or a prank. Finding this on two accounts makes me suspicious of foul play.

Question: My googling has turned up few/no reports of this being a common situation. Am I seeing a new situation? Are there known phishing attempts that create this behavior?



Yeah, because TWO users couldn't possibly make the same silly mistake. ;)

Delete it, does it come back? If so, THEN worry about it.

And if it does come back, I'd suggest starting with checking for policies pushing out rules to the user before assuming there's a huge phishing ring out there determined to move peoples emails to their recycling bin (how would that help a phisher exactly?). :)

| improve this answer | |
  • It does not come back, and I've had both users change their passwords just for fun. It definitely would not help the professional phisher. Thanks for the solid answer! – SteadH Oct 10 '14 at 22:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.