[Merged] EMail "Virus" from ntl

[paulyoung666]

Originally Posted by Grampy

Just like to thank all who responded to my post about this same problem. Would have responded on my post but it was closed by Neil before I had a chance. Not used to the search facilities on the site so didn't find this thread before making a post. Gald to find out it was a virus as I was tempted to open the attachments. The number of virus e-mails seems to be increasing daily.

no worries my mate , you will find threads closed pretty quick on here when duplication happens hope we can be of some use to you

[Stuart]

Originally Posted by zovat

with all the publicity and hooha about viruses, it is hard to believe that anyone who owns a computer which receives Email would not install and update their anti-virus sofware...


Just My 2c

Good point. People should have Antivirus and (IMO) firewalls up a running). Service Pack 2 (I am currently on the beta program for this) for XP has a nice feature. It has a security advisor that nags you until you install and enable a virus checker and a firewall. XP also nags you whenever a patch is available.

No excuse for not being up to date then..

[paulyoung666]

Originally Posted by scastle

Good point. People should have Antivirus and (IMO) firewalls up a running). Service Pack 2 (I am currently on the beta program for this) for XP has a nice feature. It has a security advisor that nags you until you install and enable a virus checker and a firewall. XP also nags you whenever a patch is available.

No excuse for not being up to date then..

is there a release date for sp2 yet ??????????

[Stuart]

Originally Posted by paulyoung666

is there a release date for sp2 yet ??????????

I think Microsoft are aiming to release it some time in the summer (possibly May or June) although don't quote me on that, they aren't at Release Candidate stage yet. Microsoft haven't emailed any release dates yet

Edit: Just checked with Betanews (http://www.betanews.com/article.php3?sid=1061289032). Seems Microsoft want to release some time in their fiscal year 2004 (which starts July 1st).

[paulyoung666]

Originally Posted by scastle

I think Microsoft are aiming to release it some time in the summer (possibly May or June) although don't quote me on that, they aren't at Release Candidate stage yet. Microsoft haven't emailed any release dates yet

Edit: Just checked with Betanews (http://www.betanews.com/article.php3?sid=1061289032). Seems Microsoft want to release some time in their fiscal year 2004 (which starts July 1st).

cheers

[ian@huth]

I have had a couple of emails today which indicate they are from postmaster(at)ntlworld.com and at first glance appear to be reports of undelivered mail but they do contain a virus. AFAIR a genuine email regarding undelivered mail from NTL would have the original email attached, is this correct?

[zovat]

Originally Posted by ianathuth

I have had a couple of emails today which indicate they are from postmaster(at)ntlworld.com and at first glance appear to be reports of undelivered mail but they do contain a virus. AFAIR a genuine email regarding undelivered mail from NTL would have the original email attached, is this correct?

You are correct mate, any returned Email would have the original Email either inline, or as an attachment..

There are loads of these around at the moment - to the extent that my company Email now strips all attachments ending in .exe, .scr, .pif, etc and stick them in a quarantine you can access if the Email turns out to be genuine... (99.99 percent so far are not...)

HTH..

[downquark1]

Just got a netsky one that had the address in:
entertainment.feedback@ntlworld.com

Strange thing is it was sent to my hotmail account.

[iadom]

Another sneaky one. W32/Netsky.P@mm
With a little note from Message Labs telling me that the file is virus free. Oh yeh


Return-Path: <n4mwd@amsat.org>
Received: from ntlworld.com ([207.61.169.20]) by mta06-svc.ntlworld.com
(InterMail vM.4.01.03.37 201-229-121-137-20020806) with ESMTP
id <20040325223310.UHYU19383.mta06-svc.n...m@ntlworld.com>
for <xxxxx@ntlworld.com>; Thu, 25 Mar 2004 22:33:10 +0000
From: n4mwd@amsat.org
To: xxxxxx@ntlworld.com
Subject: Does it matter?
Date: Thu, 25 Mar 2004 15:49:50 -0600
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0016----=_NextPart_000_0016"
X-Priority: 3
X-MSMail-Priority: Normal
Message-Id: <20040325223310.UHYU19383.mta06-svc.n...m@ntlworld.com>

This is a multi-part message in MIME format.

------=_NextPart_000_0016----=_NextPart_000_0016
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: 7bit

You have written a very good text, excellent, good work!

+++ Attachment: No Virus found
+++ MessageLabs AntiVirus - www.messagelabs.com


------=_NextPart_000_0016----=_NextPart_000_0016
Content-Type: application/octet-stream;
name="details.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="details.zip

[Prometheus]

I just got one from noreply@ray****.cl****** with the title 'Administrator'


All there was in the text was;


'Your mail account has been closed.

For further details see the document.'

Thankfully, Norton AV picks them up and bins the virus attachments before they hit my inbox, and replaces it with a small text file, containing the following;

'Norton AntiVirus removed the attachment: account.doc .scr.
The W32.Netsky.P@mm threat was detected in the attachment.'



I've been getting sent this one an awful lot recently. Isn't there a way ntl can block them as they come through the mail servers?

[hansi]

Apparently not

[Womble]

Has anyone else recieved an e-mail from ntlworld, subject-this a cracker check it out. It has a picture of a ritz cracker??

[swoop101]

I hope you have anti-virus software running.
If not then get some and run a check.

If you don't have a virus the you have probably just put yourself on a few spam lists.

Golden rule no1 do not open e-mails unless you are sure of the contents.

sorry if you feel I am having a go, but too many people just open all e-mails and get themselves into deep doo-doo.

[Womble]

Pem, you asked me to post the contents, do you mean the properties?. If so they are as follows;

Return-Path: <xxxx.xxxx@ntlworld.com>
Received: from P2600 ([81.111.112.191]) by mta08-svc.ntlworld.com
(InterMail vM.4.01.03.37 201-229-121-137-20020806) with SMTP
id <20040419151907.DTCL20754.mta08-svc.ntlworld.com@P2600>;
Mon, 19 Apr 2004 16:19:07 +0100
Message-ID: <003801c42621$a7f564f0$0200a8c0@P2600>
From: "NTL World" <xxxx.xxxx@ntlworld.com>
To: <Undisclosed-Recipient:;>
Subject: Fw: THIS IS A CRACKER... CHECK IT OUT!
Date: Mon, 19 Apr 2004 16:18:29 +0100
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0032_01C42629.F36E1910"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165

Cheers

PS; I have NAV running and upto date, as well there firewall. NAV didn't detect a virus when the mail was delivered, or when the wife (god bless her!) opened it. I know it has a picture of a cracker attached by scrolling down the mail as opposed to clicking on the attachment

Edit: NTL e-mail address blocked out.

[Womble]

This is the trace from the ip addy


NeoTrace Trace Version 3.25 Results
Target: 81.111.112.191
Date: 19/04/2004 (Monday), 21:03:46
Nodes: 11


Node Data
Node Net Reg IP Address Location Node Name
1 - - 192.168.1.2 Sutton bert
2 1 - 10.44.32.1 Unknown
3 2 1 80.3.34.141 Northavon herm-t2cam1-b-ge-wan34-104.inet.ntl.com
4 2 1 80.3.33.133 Unknown herm-t2core-b-ge-wan61.inet.ntl.com
5 3 1 62.253.187.21 Unknown pop-bb-b-so-210-0.inet.ntl.com
6 3 1 213.105.172.137 Guildford gfd-bb-a-so-500-0.inet.ntl.com
7 3 1 213.105.172.6 Guildford gfd-bb-b-ae0-0.inet.ntl.com
8 3 1 62.253.185.54 Unknown sot3-t2core-b-pos31.inet.ntl.com
9 2 1 80.4.225.134 Northavon sot3-t2cam1-b-ge-wan31.inet.ntl.com
10 2 1 80.4.226.142 Unknown ubr04sout-ge20.inet.ntl.com
11 4 1 81.111.112.191 Unknown spr1-sout4-4-0-cust191.cosh.broadband.ntl.com


Packet Data
Node High Low Avg Tot Lost
1 0 0 0 1 0
2 13 13 13 1 0
3 10 10 10 1 0
4 11 11 11 1 0
5 11 11 11 1 0
6 16 16 16 1 0
7 15 15 15 1 0
8 18 18 18 1 0
9 17 17 17 1 0
10 18 18 18 1 0
11 ---- ---- ---- 2 2


Network Data
Network id#: 1

OrgName: Internet Assigned Numbers Authority
OrgID: IANA
Address: 4676 Admiralty Way, Suite 330
City: Marina del Rey
StateProv: CA
PostalCode: 90292-6695
Country: US

Network id#: 2

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: Singel 258
Address: 1016 AB
City: Amsterdam
StateProv:
PostalCode:
Country: NL

Network id#: 3
NTL Internet
Crawley Court
Winchester
Hampshire
SO21 2QA

Network id#: 4

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: Singel 258
Address: 1016 AB
City: Amsterdam
StateProv:
PostalCode:
Country: NL



Registrant Data
Registrant id#: 1
Registrant:
NTL Internet Ltd (NTL5-DOM)
Dunleavy Drive
Cardiff, CF11 0WW
UK

_____
NeoTrace Copyright ©1997-2001 NeoWorx Inc