NTL Anti Virus Sevice

jambolino · 19-11-2004, 18:07

I have been getting some mail with attachments (containing a virus). Fortunately Norton Antivirus on my system quaratined them, so they caused me no problems.

HOWEVER... when reading the actual mail not the attachment, it says that the mail has been checked by the NTL' anti virus service (see below):

*-*-* Attachment: No Virus found

*-*-* NTLWORLD- Anti_Virus Service

*-*-* http://www.ntlworld.com

The report from my Norton Anti Virus log against this file reads:

Norton AntiVirus removed the attachment: im_shocked_4033.eml.scr.
The attachment was infected with the W32.Sober.I@mm virus.

If indeed NTL have introduced virus scanning on all e-mail this service does not work, so everyone beware.

Anyone else seen this?

paulyoung666 · 19-11-2004, 19:29

hi and

to the site , i aint seen this on any of my ntl e-mails which leads me to believe it is a scam to make you think they are ok

, does this appear on all ntl e-mails or not ??????

ian@huth · 19-11-2004, 19:41

A well known trick to put messages such as this in emails to make the recipient think it is OK to open the attachment. DONT.

19-11-2004, 19:43

The three *** lines you quote are automatically generated by the W32.Sober.I virus, based on the domain in your e-mail address. They are NOTHING to do with NTL, and DO NOT mean the attachment has been virus-checked. I got one of these today at work, and the text said it had been virus-checked by our company (i.e. the first part of the e-mail domain name).

paulyoung666 · 19-11-2004, 19:55

Quote:

Originally Posted by ianathuth

A well known trick to put messages such as this in emails to make the recipient think it is OK to open the attachment. DONT.

kinda what i thought

Quote:

Originally Posted by JohnHorb

The three *** lines you quote are automatically generated by the W32.Sober.I virus, based on the domain in your e-mail address. They are NOTHING to do with NTL, and DO NOT mean the attachment has been virus-checked. I got one of these today at work, and the text said it had been virus-checked by our company (i.e. the first part of the e-mail domain name).

good info my mate

jambolino · 19-11-2004, 20:05

Quote:

Originally Posted by JohnHorb

The three *** lines you quote are automatically generated by the W32.Sober.I virus, based on the domain in your e-mail address. They are NOTHING to do with NTL, and DO NOT mean the attachment has been virus-checked. I got one of these today at work, and the text said it had been virus-checked by our company (i.e. the first part of the e-mail domain name).

Thanks JohnHorb, It's been a long, long week, I should have seen this one, just looked on the Symentec.com website, this reiterates exactly what you was saying, thanks again.

19-11-2004, 20:10

Did you really look at the sym-e-ntec.com web site? Last time I made that mistake, I got a porn site!

jambolino · 19-11-2004, 20:15

Quote:

Originally Posted by JohnHorb

Did you really look at the sym-e-ntec.com web site? Last time I made that mistake, I got a porn site!

oooooooooooops, no it was the Symantec.com site!!

Neil · 19-11-2004, 20:23

*Moved to EMail Discussion forum*

ikthius · 22-11-2004, 18:15

I think NTL should get rid of their antivirus service, cause I have had about 50 today, when before they introduced it I had nearly 2 a month.

here is the contents of the email after ntl antivirus and after my anti virus deleted the threat.

Quote:

This mail was generated automatically.
More info about --HOTMAIL-- under: http://www.hotmail.com

-------
Occured_Errors:

101.220.51.48_does_not_like_recipient.
# 138: This_account_has_been_discontinued_[#480].
# 335: MAILBOX NOT FOUND
# 519: Remote_host_said:_delivery_error

End
-------

The full mail is attached.

Auto_Mail.System: [hotmail]

*-*-* Anti_Virus: No Virus was found
*-*-* NTLWORLD- Anti_Virus Service
*-*-* http://www.ntlworld.com

what is going on then?

ik
p.s. if any mods thinks that any IP Addresses and number in this message should be deleted please do so.

paulyoung666 · 22-11-2004, 18:36

you aint alone my mate , i have had ****loads of these

ian@huth · 22-11-2004, 18:42

If NTL are running an anti-virus service, how can it generate emails with virii in them. It can't be responsible for you getting more.

The message in the email that it has been checked by NTL anti-virus software is put there to make you think it is safe to open the attachment. It isn't safe to do so, it is a con.

22-11-2004, 20:45

Exactly - read my earlier post - this is all the W32.Sober.I virus's work. AFAIK NTL's anti-virus service starts 'End of November'.