[Merged] EMail "Virus" from ntl

[grahamj]

Originally Posted by 2old4this

Got this


Dear user of Ntlworld.com gateway e-mail server,

Your e-mail account will be disabled because of improper using in next
three days, if you are still wishing to use it, please, resign your
account information.

For more information see the attached file.

Kind regards,
The Ntlworld.com team http://www.ntlworld.com

such bad grammer etc.

improper using? me thinks improper usage in the ....

the ntlworld.com team. never ever seen a email from them saying that...
usually its from

regards,
first name second name
ntl whatever (cus services etc)

[Theodoric]

Originally Posted by Kedoo

NTL would never send attachments in the email....
<Snip>

ntl may not send emails with attachments but they do send emails containing links. There was a one discussed here fairly recently that linked to Microsoft through some dubious advertising site. Isn't that almost as bad?

[paulyoung666]

heres another variation


Hello user of Ntlworld.com e-mail server,

Our antivirus software has detected a large ammount of viruses outgoing
from your email account, you may use our free anti-virus tool to clean up
your computer software.

For details see the attached file.

Sincerely,
The Ntlworld.com team http://www.ntlworld.com

[Mabus117]

I posted details of the virus message to NTL's Abuse service and received the following reply:

"************************************************* *************************************
**PLEASE NOTE THIS IS AN AUTORESPONDER FROM THE NTL ACCEPTABLE USE POLICY (AUP) TEAM**
************************************************** ************************************

Latest News 03 March 2004:

Customers are reporting emails arriving in their mailboxes with an attachment and the subject of the email starts with - Email account

This email appears to come from ntlworld personnel, but we can confirm that this is a virus.

Please visit the following website for further information.

http://securityresponse.symantec.com/avcenter/venc/data/w32.beagle.k@mm.html


If you think you may be infected with this virus you may find this removal tool of use.

http://vil.nai.com/vil/stinger/

This email has not come from the ntl management, and has a potentially harmful attachment. Delete the email and do not run the attachment.

*****************************************
Latest News 03 March 2004:

Please note that W32.Netsky.D worm is rapidly spreading across the internet.

For further information regarding this worm and a removal tool please visit this webpage:
http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky.d@mm.html

*****************************************

Reports can now be submitted by using the following web form: http://www.ntlworld.com/netreport

We have introduced this new web form to allow more accurate reporting of network abuse and to allow us to deal with reports more quickly. We would recommend that anyone who wishes to fasttrack their report to us, uses the web form.

********************************


Dear Internet User

Thank you for your mail.

Due to the sheer volume of mails received daily (many which are duplicated complaints, e.g. multiple complaints from different sources concerning the same incident), in normal circumstances the AUP Team will not respond to your query personally (this is the only response you will receive from us).

Full information on how to report abuse can be found at http://www.ntlworld.com/help/aup/abuse.html .

Please ensure you read the information held at the above link as we are not able to take any action if the correct information has not been sent to us.

We are only able to deal with complaints that specifically relate to misuse of an Internet account on the NTL network.

To ensure any other enquiries you may have are directed to the correct department, please use the following link: http://www.ntlhome.com/contact/ .
The form on this webpage allows you to give us a full description of your enquiry which will enable ntl:home to deal with your enquiry more effectively.

To visit our online help section, visit: http://www.ntlworld.com/help . The AUP help pages contain useful information on many aspects on Internet security.

If you would like advice on how to deal with spam/unsolicited-commercial-email please view: http://www.ntlworld.com/help/aup/dealingwithspam.html

If you have any questions related to telephony , tv, cablemodem billing etc please call your local franchise on either 151 from your ntl line or 0800 052 2000 from any other line.

If you are receiving Nuisance Phone Calls there is a free advice line on 0800 052 1370

Regards

The ntl Acceptable Use Policy Team, Cardiff. [ Office Hours : 0800-1600hrs Monday to Friday ]

Last amended 3/4/4. Ref. OH."

Given the speed at which viruses replicate themselves, I find it disconcerting that they have held onto this information in such a secretive manner for so long.

[Marge]

I am getting really cheesed off with this virus, out of 8 emails I've received today, 4 have contained the virus so now I'm too nervous to open any emails at all..... strangely nothing from the ntlworld version

[paulyoung666]

Originally Posted by Debsy42

I am getting really cheesed off with this virus, out of 8 emails I've received today, 4 have contained the virus so now I'm too nervous to open any emails at all..... strangely nothing from the ntlworld version

yup , getting to be a right pain in the proverbial

[highlandlassie]

getting at least 8 a day - been like that since last week - thankfully I use mailwasher as well and just delete direct from there

[das316]

The reason people are getting so many is because of this read it Last week on the BBC web site

A war of words is breaking out between the creators of the Netsky, Bagle and MyDoom Windows worms.
The malicious programs' creators are putting taunts and insults in successive variants of their viruses.

The spat began because Bagle's creators are jealous of all the media attention that the Netsky virus is getting

Anti-virus firms discovered the insults inside the viruses when they were being taken apart to find out how they differed from earlier versions of these malicious programs.

Inside Bagle.J, along with a string of profanity, is a message reading: "don't ruine (sic) our bussiness, wanna start a war?"

The response to this seems to be inside Netsky.F, released the day after Bagle.J, which contains a message reading: "Bagle - you are a looser!!!! (sic)".

So it looks like its going to be a long hall of virus deleting if it carries on for long enough they could make an olympic event out of it

[Jon_]

grrr ive had a load of emaills with a short sentance and attachment, now more recently spoofed ones from ntl, all from a ntl cable user in nottingham. the most recent ip is 81.108.70.139 , hope i aint breaking any rules posting that.

the thing is all the emails are coming on a email address i NEVER use for anything, its in my ntl account name, but it is on a spam list, im gussing either ntl sold some lists, or someone worked out the url to ntl webspace is the same as the email addy

i dont know anyone in nottingham so im guessing the virus found my address from a spam sent to all ntl users, i just wish there was something i could do to get things sorted

[mrmassive]

Ive had a few of these but the ones i only get are hard porn from ntlworld.com update lol

[hansi]

I had an e mail from:3dgellybean@ntlworld.com which contained a virus sent to me at work but the AV programme caught it and confirmed that it contained a virus

[Millay]

Interesting I received a similar email a few weeks ago. I have my own mail server hosted by my ISP and have 3 pop3 accounts set up on it. I received this email, supposedly eminating from my domain with the same virus in it...

From: administration@behindthestorm.com [mailto:administration@behindthestorm.com]
Sent: 02 March 2004 23:04
To: andy@behindthestorm.com
Subject: Notify about using the e-mail account.

Dear user of Behindthestorm.com,

Your e-mail account has been temporary disabled because of unauthorized access.

Pay attention on attached file.

Sincerely,
The Behindthestorm.com team http://www.behindthestorm.com



I wonder how there doing this one?

[ICICLE65]

Had various E-mails with said attachment over the last 6 months, even getting them from Barclays and Lloyds' banks !!!!! Never banked with either !!!!

Surely Ntl can detect these E-mail viruses and bounce them back to source ! This is the 21st Century after all !

[zovat]

Originally Posted by ICICLE65

Had various E-mails with said attachment over the last 6 months, even getting them from Barclays and Lloyds' banks !!!!! Never banked with either !!!!

Surely Ntl can detect these E-mail viruses and bounce them back to source ! This is the 21st Century after all !

Unfortunately it is hard bounce these back to source, as the source is invariably either spoofed os someone on the same ISP - they result would be that the bounced mail would then be bounced back and so on.....

They could detect they viruses by installing some anti-virus software on their mail servers, but that is very expensive when you are a corporate entity as large as NTL (and as short of cash).
In fairness, why should NTL shoulder the responsibility for people who cannot install/maintain their own AV software. It is not NTLs fault that people are daft/non technical enough to not check these attachments and mails before they execute them.

with all the publicity and hooha about viruses, it is hard to believe that anyone who owns a computer which receives Email would not install and update their anti-virus sofware...


Just My 2c

[Grampy]

Just like to thank all who responded to my post about this same problem. Would have responded on my post but it was closed by Neil before I had a chance. Not used to the search facilities on the site so didn't find this thread before making a post. Gald to find out it was a virus as I was tempted to open the attachments. The number of virus e-mails seems to be increasing daily.