PDA

View Full Version : Virus infect user

mmm
13-03-2004, 17:22
I have been receiving dozens of virus infected emails from a northampton cable modem user (every day for the last couple of weeks), how do I tell him?
Headers include


Received: from ntlworld.com ([81.107.108.242]) by mta04-svc.ntlworld.com
(InterMail vM.4.01.03.37 201-229-121-137-20020806) with ESMTP
id <20040313163821.CSXC4168.mta04-svc.ntlworld.com@ntlworld.com>

cpc3-nthc2-4-0-cust242.nrth.cable.ntl.com [81.107.108.242]

The IP resolves to, he is online now without a firewall?

I reported dozens to

http://www.ntlworld.com/netreport/

but they are presumably too busy to care?
Caspar
13-03-2004, 17:25
try: abuse@ntlworld.com
mmm
13-03-2004, 17:32
try: abuse@ntlworld.com

Tried that, the standard message gave the above web form as a better route!
swoop101
13-03-2004, 17:58
have you tried sending one back to them?
paulyoung666
13-03-2004, 18:05
what about windows messenger :shocked: :shocked: :shocked:
Tricky
13-03-2004, 18:42
at a guess they are running a mail server and someone is using his server to bounce mails - happened to a mate of mine and he never noticed until he spotted is bandwidth being hammered!
mmm
13-03-2004, 20:54
have you tried sending one back to them?

The email addresses and hostname are fake, but I believe the IP address added by the ntl mailserver is correct.

I've just had another 4 copies of the virus from a Luton cable modem now, someone else in this friend of a friend network must have been infected!
mmm
15-03-2004, 22:27
at a guess they are running a mail server and someone is using his server to bounce mails - happened to a mate of mine and he never noticed until he spotted is bandwidth being hammered!

Well posting the IP in here has done the trick - coincidence?

Now several copies a day from what I think is hong-kong, don't suppose I can blame an ntl customer for that!

Received: from bigfoot.com ([218.189.242.15])
by BFLITEMAIL-KR1.bigfoot.com (LiteMail v3.03(BFLITEMAIL-KR1)) with SMTP id 0403142049_BFLITEMAIL-KR1_230447_20708265;
Sun, 14 Mar 2004 20:55:58 -0500 EST

Spamcop says they are from hgcbroadband.com
Paul
16-03-2004, 00:36
Who do you know in hong kong then ......
Nikko
16-03-2004, 00:44
Who do you know in hong kong then ......

My ex signed up with a Honk Kong provider

I assume so anyway - the content of her mail was from KowLoon
danielf
16-03-2004, 00:57
My ex signed up with a Honk Kong provider

I assume so anyway - the content of her mail was from KowLoon

So which one was it? The jade market, the night market, the birds market or the ladies market? ;)
Nikko
16-03-2004, 01:04
So which one was it? The jade market, the night market, the birds market or the ladies market? ;)


I think you have it there in reverse order - culminating in the flea market ;)
mmm
16-03-2004, 18:08
Who do you know in hong kong then ......

The only thing I can think is that I was recently sent a webmail by a mate on holiday there. Wouldn't put it past a dodgy internet cafe to cache the email addresses?

Or it could have been one of those joke emails I passed on, and a few generations later its stored on a PC that gets infected.