beware upload.ntlworl.com! [Archive]

spiderplant

27-01-2004, 17:32

I've just fallen for typing my username and password into an FTP server at upload.ntlworl.com. Doh! At least I realised pretty quickly and have now changed my password.

One to watch out for.

paulyoung666

27-01-2004, 17:47

I've just fallen for typing my username and password into an FTP server at upload.ntlworl.com. Doh! At least I realised pretty quickly and have now changed my password.

One to watch out for.

i wondered what the hell you were on about for a minute until i read it properly :knock: , where did that come from :confused:

clammit

27-01-2004, 18:09

I think that recent ntl upgrades might have left us vulnerable.

I've just had an email 'returned' from
"stephen@sauldharrison.com"
because:
"Your message (header below) has been deleted because of the following error:
A virus of type Unidentified Virus was detected in attachment document.zip"

No email sent to them by me and never had that kind of messangs sent to me. Virus check said everything OK.
Any suggestions, anyone?

Kneebs

27-01-2004, 18:16

I think that recent ntl upgrades might have left us vulnerable.

I've just had an email 'returned' from
"stephen@sauldharrison.com"
because:
"Your message (header below) has been deleted because of the following error:
A virus of type Unidentified Virus was detected in attachment document.zip"

No email sent to them by me and never had that kind of messangs sent to me. Virus check said everything OK.
Any suggestions, anyone?

Probably someone else spamming / sending out the virus, with lots of different faked from addresses - yours will be one of many I'd imagine

clammit

27-01-2004, 18:24

Probably someone else spamming / sending out the virus, with lots of different faked from addresses - yours will be one of many I'd imagine

I don't think my address is one that would be guessed - I'm thinking that it must have been taken from a list. ?

Kneebs

27-01-2004, 18:33

I don't think my address is one that would be guessed - I'm thinking that it must have been taken from a list. ?

Yep, that or maybe one of your pals has your address stored in their address book, and they've got the virus, and its gone through the list, harvesting all the address

Shaun

27-01-2004, 18:50

I've just fallen for typing my username and password into an FTP server at upload.ntlworl.com. Doh! At least I realised pretty quickly and have now changed my password.

One to watch out for.

Have you let Ntl know about this? I believe that the e-mail addy is abuse@ntl.com ;)

spiderplant

27-01-2004, 19:08

I will email the abuse mailbox, but I doubt there's anything they can do (apart from warn other users).

SamSpade says that ntlworl.com is registered in Korea.

goldfrog

27-01-2004, 19:15

I think that recent ntl upgrades might have left us vulnerable.

I've just had an email 'returned' from
"stephen@sauldharrison.com"
because:
"Your message (header below) has been deleted because of the following error:
A virus of type Unidentified Virus was detected in attachment document.zip"

No email sent to them by me and never had that kind of messangs sent to me. Virus check said everything OK.
Any suggestions, anyone?
Looks like the Mydoom virus Look here (http://news.bbc.co.uk/1/hi/technology/3432639.stm)

clammit

27-01-2004, 19:18

Yep, that or maybe one of your pals has your address stored in their address book, and they've got the virus, and its gone through the list, harvesting all the address

Thanks. I shouldn't have jumped to the conclusion that it was in any way ntl's fault. Habit I suppose.

Alan Waddington

27-01-2004, 21:38

I think ntlworl.com has a wildcard in its DNS since I can ping pretty much anything

C:\Documents and Settings\Alan Waddington>ping *********.ntlworl.com

Pinging *********.ntlworl.com [220.80.108.83] with 32 bytes of data:

Reply from 220.80.108.83: bytes=32 time=321ms TTL=241
Reply from 220.80.108.83: bytes=32 time=309ms TTL=241
Reply from 220.80.108.83: bytes=32 time=327ms TTL=241
Reply from 220.80.108.83: bytes=32 time=309ms TTL=241

Ping statistics for 220.80.108.83:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 309ms, Maximum = 327ms, Average = 316ms

Paul

27-01-2004, 21:55

and the IP is also Korean - KOREA TELECOM to be exact.

SOSAGES

27-01-2004, 22:44

fiendish little buggers

Marge

27-01-2004, 22:45

I think ntlworl.com has a wildcard in its DNS since I can ping pretty much anything

C:\Documents and Settings\Alan Waddington>ping *********.ntlworl.com

Pinging *********.ntlworl.com [220.80.108.83] with 32 bytes of data:

Reply from 220.80.108.83: bytes=32 time=321ms TTL=241
Reply from 220.80.108.83: bytes=32 time=309ms TTL=241
Reply from 220.80.108.83: bytes=32 time=327ms TTL=241
Reply from 220.80.108.83: bytes=32 time=309ms TTL=241

Ping statistics for 220.80.108.83:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 309ms, Maximum = 327ms, Average = 316ms

:rofl: :rofl: :rofl: class

MovedGoalPosts

27-01-2004, 23:44

I think that recent ntl upgrades might have left us vulnerable.

I've just had an email 'returned' from
"stephen@sauldharrison.com"
because:
"Your message (header below) has been deleted because of the following error:
A virus of type Unidentified Virus was detected in attachment document.zip"

No email sent to them by me and never had that kind of messangs sent to me. Virus check said everything OK.
Any suggestions, anyone?

THIS IS A NEW VIRUS (Apologies for the shouting!) Dont open the .zip file.

it comes in other forms too with headers on email such as Test etc. My office got bombarded with over 100 dodgy emails today :eek:

The virus has spread like wildfire throughout the day. It's called Novarg or Mydoom depending on your A/V provider, and is potentially far bigger than SoBig which hit last year.

Everybody should ensure they have updated their antivirus software, even if they only did so yesterday.

poolking

28-01-2004, 07:00

I think that recent ntl upgrades might have left us vulnerable.

I've just had an email 'returned' from
"stephen@sauldharrison.com"
because:
"Your message (header below) has been deleted because of the following error:
A virus of type Unidentified Virus was detected in attachment document.zip"

No email sent to them by me and never had that kind of messangs sent to me. Virus check said everything OK.
Any suggestions, anyone?
Are you sure your anti-virus definitions are up to do date?

I use AVG and it flagged up these emails as having the new virus attached.

clammit

28-01-2004, 13:34

Are you sure your anti-virus definitions are up to do date?

I use AVG and it flagged up these emails as having the new virus attached.

Yes they are. And I've re-checked.

I haven't received the email with the worm in the attachment. I don't open attachments unless I know who sent them and what they are.