Who's been a naughty boy???

iadom · 05-04-2005, 11:32

I have just received an e-mail from Ntl & Virgin net AUP telling me that they have received a report of internet abuse from me. Case Reference C114949
Windows is always fully patched. XP firewall disabled.
I use Authentium AV set to scan daily, it also auto updates its deffiles, sometimes two or three times each day.
I have ZA Pro, Pest Patrol ( paid for ) AdAware, Spybot, MS beta AntiSpyeware, SpyewareBlaster and also Prevx Home installed. I use these to scan my system on a regular basis.
The only thing found recently was a 'Web Trends' item in Spybot.
All other scans are clean.
I also use an utility called VisualZone which is an add on for ZoneAlarm, it gives much more info. It has a facility called 'Backtrace' which can be used for tracing scan attempts. I have this disabled and only ever use it on very rare occasions when a single IP shows up in my firewall logs many times. Could this be construed as a 'port scan'. It would be ironic if I have been reported by an individual who actually does have an infected PC.
I don't often send in abuse reports, only when I see long term hits from the same source, yesterday I reported an Ntl IP , from stretford/baguley that had scanned port 135 on 71 occasions in the past 10 days, ( suspect Blaster infection).
Could it be that AUP have recieved my report and sent me the abuse notification in error.
I had the previous IP ever since I went on BB over three years ago, this only changed a couple of weeks ago when I had a Samsung STB and a 2meg upgrade.
Since then I have noticed a huge increase in firewall activity, mainly ports, 135,139,445 & the 1026 to 9 range.

I believe there is an AUP team member on the forum, if you read this could you please contact me.

Paul K · 05-04-2005, 12:09

I'd contact them and ask for details and proof that it any abuse was initiated from your connection. If you have recently changed to a new IP address after the speed upgrade it could be the ex-owner of that IP that caused the problem so make sure you make them aware of when you changed IP and if possible what your old IP address was prior to the upgrade.

iadom · 05-04-2005, 14:16

I have details of both old & new IP, have also sent a reply to the link in the warning e-mail.
__________________

Hooray, seems I am an

after all.

Have just received this reply from AUP.

Dear Mr Banks

Thank you for your response. The email that you received was sent to you in
error, please disregard it.

Yours Sincerely

name removed - Acceptable Use Policy Team

th'engineer · 05-04-2005, 15:12

Quote:

Originally Posted by iadom

I have details of both old & new IP, have also sent a reply to the link in the warning e-mail.
__________________

Hooray, seems I am an

after all.

Have just received this reply from AUP.

Dear Mr Banks

Thank you for your response. The email that you received was sent to you in
error, please disregard it.

Yours Sincerely

name removed - Acceptable Use Policy Team

I wonder what had happened to Fraz looks like he is s till there in AUP

iadom · 05-04-2005, 18:55

I have just taken the time to read all of the e-mail from Ntl and it refers to my "Internet Account No: xxxxxxx, I have just checked and this number does not correspond to any details I have, PID, main account No:, original password etc, Is my real 'Internet Account No:' my overall Ntl account number ?

th'engineer · 05-04-2005, 19:00

Quote:

Originally Posted by iadom

I have just taken the time to read all of the e-mail from Ntl and it refers to my "Internet Account No: xxxxxxx, I have just checked and this number does not correspond to any details I have, PID, main account No:, original password etc, Is my real 'Internet Account No:' my overall Ntl account number ?

Now come on your sounding surprised that they got it wrong

crikey how many years have you had NTL.

How many years have you been with this forum and previous incarnations

iadom · 05-04-2005, 19:19

Quote:

Originally Posted by th'engineer

How many years have you been with this forum and previous incarnations

I could say, far to long, but that would not be true,

Anyone can make a mistake, and I did receive a fairly swift apology.

Perhaps I should ask for compensation for the stress and inconvenience,

I do like the poor grammar in the first line of the e-mail though.

"The ntl acceptable use policy team have received a report that indicates that a
ntl Internet account has been used to scan other networks for vulnerabilities".

Paul K · 05-04-2005, 20:02

Quote:

Originally Posted by iadom

Quote:

Originally Posted by th'engineer

How many years have you been with this forum and previous incarnations

I could say, far to long, but that would not be true,

Anyone can make a mistake, and I did receive a fairly swift apology.

Perhaps I should ask for compensation for the stress and inconvenience,

I do like the poor grammar in the first line of the e-mail though.

"The ntl acceptable use policy team have received a report that indicates that a
ntl Internet account has been used to scan other networks for vulnerabilities".

Good thing you contacted them and found out, knowing how things go with NTL you could have lost your connection before they realised the error

th'engineer · 05-04-2005, 21:09

Quote:

Originally Posted by Paul

Good thing you contacted them and found out, knowing how things go with NTL you could have lost your connection before they realised the error

I agree with you

Chris W · 05-04-2005, 21:39

Quote:

Originally Posted by iadom

I have just taken the time to read all of the e-mail from Ntl and it refers to my "Internet Account No: xxxxxxx, I have just checked and this number does not correspond to any details I have, PID, main account No:, original password etc, Is my real 'Internet Account No:' my overall Ntl account number ?

I believe the number on the letter will be your "subscriber number" - you will have been given this when you registered for email, but it isn't fundamentally important! Does it begin with the number 5 by any chance?

iadom · 06-04-2005, 00:11

Quote:

Originally Posted by monkeybreath

I believe the number on the letter will be your "subscriber number" - you will have been given this when you registered for email, but it isn't fundamentally important! Does it begin with the number 5 by any chance?

No, seven digit number starts with 285, I have no number anything like this, Ntl related. Original e-mail number began with b0423xxxxx

Chris W · 06-04-2005, 00:17

tis probably the subsriber number then.... (unless of course AUP sent the mail to completely the wrong address!)

The subsciber account is the one that holds the email address details for STB customers

iadom · 06-04-2005, 00:28

Quote:

Originally Posted by monkeybreath

(unless of course AUP sent the mail to completely the wrong address!)

mrlipring · 06-04-2005, 04:10

In these situations, there's also the possibility that someone has cloned your modem, and is doing naughty things. I'd imagine that NTL have a solution to stop modems being cloned (else how are they going to monitor who's actually using the bandwidth they intend to monitor?).

BBKing · 06-04-2005, 08:00

Quote:

In these situations, there's also the possibility that someone has cloned your modem

Why would someone clone an STB MAC? You'd need the PID and password in order to get online through it, and those aren't available unless you know who had the original box and tortured them for the information!