[Merged] EMail "Virus" from ntl

[zovat]

Originally Posted by stuartbe

Duplicate Thread !

http://forum.nthellworld.co.uk/showthread.php?t=8779

spoilsport....

But seriously folks, this worm picks up your address and spoofs the mail as from someone in that domain - normally either noreply or admin (but others are becoming more common).

I have a feeling that the password encrypted attachment helps it get through virus scanners ... These people obviously have Waaay too much time on their hands...

[Stuartbe]

If you run your own mail server ( like I do ) then this is not a problem. I only allow zip files into the network and they are only let in if they can be scanned.

[rdhw]

Originally Posted by timewarrior2001

Can the true sender be established form the email header?

The true sender PC will normally have the IP address identified in the final "Received:" header. This does not tell you the e-mail address of the sender, just their IP address.

[highlandlassie]

still getting these emails - thankfully I now know they are not from NTL

[SMHarman]

Its very neat how it harvests the address from after the @ to make the message more personalised. More likely to get users to open it.

Were getting it at my eers .com address.

[iadom]

WM32/Bagle.K@MM detected earlier today

[mick44]

can anyone tell me if an email i recieved did actually come from ntl it has me a bit worried as i know my machine is is virus free .


Dear user of Ntlworld.com gateway e-mail server,

Our antivirus software has detected a large ammount of viruses outgoing
from your email account, you may use our free anti-virus tool to clean up
your computer software.

Further details can be obtained from attached file.

Attached file protected with the password for security reasons. Password is 54881.

Have a good day,
The Ntlworld.com team


many thanks
mick

[andygrif]

No...don't touch this mail. We've had a similar one at work today...actually I say similar, it's identical apart from the domain name and company name. It looks legit, but it's not. Delete it.

[paulyoung666]

Originally Posted by mick44

can anyone tell me if an email i recieved did actually come from ntl it has me a bit worried as i know my machine is is virus free .


Dear user of Ntlworld.com gateway e-mail server,

Our antivirus software has detected a large ammount of viruses outgoing
from your email account, you may use our free anti-virus tool to clean up
your computer software.

Further details can be obtained from attached file.

Attached file protected with the password for security reasons. Password is 54881.

Have a good day,
The Ntlworld.com team


many thanks
mick

hi and to the site , did it have a virus attached to it ??????????? , and have you done a virus scan to check you are in the clear

Couple of things that would question its authenticity. Never known ntl to sign off emails with 'Have a nice day, The Ntlworld.com team'. Plus there is only one 'm' in amount.

[br3ach]

NTL would never send attachments in the email....

I have posted this on a different forum today...

Dont open any attachments unless the person it is from has specificly told you they are sending it.

Curiosity will get you in trouble.

Any updates that are available that NTL will tell you about will be available through windows update, so why risk the attachment anyway....

HTH

[paulyoung666]

Originally Posted by Mick

Couple of things that would question its authenticity. Never known ntl to sign off emails with 'Have a nice day, The Ntlworld.com team'. Plus there is only one 'm' in amount.

good point my mate , it is surprising how many of these mails have atrocious speelling

[LynneC]

Originally Posted by Kedoo

Possibly. Post the headers here, and we'll see....

I use Eudora. Here's the message with the headers expanded to show all the information (the virus was in the attachment which has now been zapped).

Return-Path: <9.FCD0BD98@home.ease.lsoft.com>
Received: from celeron1 ([213.48.235.184]) by mta04-svc.ntlworld.com
(InterMail vM.4.01.03.37 201-229-121-137-20020806) with SMTP
id <20040303111331.YUVU20489.mta04-svc.ntlworld.com@celeron1>
for [Admin Edit(Mick): Email address Removed.]; Wed, 3 Mar 2004 11:13:31 +0000
Date: Wed, 03 Mar 2004 11:15:49 +0000
To: [Admin Edit(Mick): Email address Removed.]
Subject: Notify about your e-mail account utilization.
From: support@NTLWORLD.COM
Message-ID: <hbxjfhuibnebiblsecj@NTLWORLD.COM>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--------snxkidupvhljxcojtdok"


Dear user of "NTLWORLD.COM" mailing system,

Some of our clients complained about the spam (negative e-mail content)
outgoing from your e-mail account. Probably, you have been infected by
a proxy-relay trojan server. In order to keep your computer safe,
follow the instructions.

For details see the attached file.

For security purposes the attached file is password protected. Password is "32585".

Kind regards,
The NTLWORLD.COM team http://www.nTLWORLD.COM

[LynneC]

Originally Posted by LynneC

I use Eudora. Here's the message with the headers expanded to show all the information (the virus was in the attachment which has now been zapped).

Return-Path: <9.FCD0BD98@home.ease.lsoft.com>
Received: from celeron1 ([213.48.235.184]) by mta04-svc.ntlworld.com
(InterMail vM.4.01.03.37 201-229-121-137-20020806) with SMTP
id <20040303111331.YUVU20489.mta04-svc.ntlworld.com@celeron1>
for [Admin Edit(Mick): Email address Removed.];Wed, 3 Mar 2004 11:13:31 +0000
Date: Wed, 03 Mar 2004 11:15:49 +0000
To: [Admin Edit(Mick): Email address Removed.]
Subject: Notify about your e-mail account utilization.
From: support@NTLWORLD.COM
Message-ID: <hbxjfhuibnebiblsecj@NTLWORLD.COM>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--------snxkidupvhljxcojtdok"


Dear user of "NTLWORLD.COM" mailing system,

Some of our clients complained about the spam (negative e-mail content)
outgoing from your e-mail account. Probably, you have been infected by
a proxy-relay trojan server. In order to keep your computer safe,
follow the instructions.

For details see the attached file.

For security purposes the attached file is password protected. Password is "32585".

Kind regards,
The NTLWORLD.COM team http://www.nTLWORLD.COM

[Riddles]

I've just recieved this email:

Dear user of Ntlworld.com,

Your e-mail account has been temporary disabled because of unauthorized access.

For more information see the attached file.

Attached file protected with the password for security reasons. Password is *****.

Sincerely,
The Ntlworld.com team http://www.ntlworld.com


Thought it quite strange so came on here to check it out.