I'm being Joe-Jobbed from an NTL address

[BootBoy]

Help!!!

I recently started getting email bounce notifications to 2 of my domain address's. After tracing the header, it appears the spammer is on the NTL network.

I would dearly like to know who is doing this and why, but I understand that it would be more than somebody's job's worth to divulge that info.

I would however like to see the offending machine removed from the network.

Can anybody help me.

I am going to mail the NTL abuse address with the info, but I know that responses from AUP can be a little slow.

I have the octet and the long address and can either post it here if that's acceptable, or PM it to anybody that may be able to help.

Thanks in advance for any replies.

Tony

[Chris W]

fill in the form at www.ntlworld.com/netreport

if someone is spamming from an ntl ip address the aup will soon pickup on it and get block them anyway.

If you have the ip address, pm it to me (and the full headers if you can), and i will have a look at this for you

MB

[BootBoy]

Thanks for the offer Monkey. I've PM'd you some details and I have also filled in the form.
I am interested in the originator of these spams, as they appear to be coming from a machine around Leeds, which is where I am.

I guess it could be that someone with my address in their address book has been compromised, and the spam engine is picking names at random. If that's the case, It will probably be me that has to go fix that machine.
I am the "free PC support" dude for several machines in Leeds. That would be an irony, would it not? Being Joejobbed from a PC I maintain!

What goes around, comes around.

[Chris W]

LOL

I have passed the information to the appropriate people, but i can't give you any information about who the spam is coming from because of data protection, but hopefully it will all be fixed soon

If someone has a virus on their pc then they will be given appropriate links to fix it and if it is deliberate spamming, then other action will be taken

MB

[Russ]

If only Fraz still posted here.......

[Chris W]

Originally Posted by Russ D

If only Fraz still posted here.......

[Russ]

You know, the guy who used to work for ntl's AUP....

[BootBoy]

Fully understand the DPA implications, I am in IT in a different context(Inhouse development/analysis on midrange machines).

I expect to get a call from a family member or friend in the next couple of days: " I'm can't access the 'net and I'm getting this page that says stuff I don't understand"
In which case all is well and I can go and fix it for them, If it isn't somebody I know with a compromised machine, then I'm at a loss to understand why anybody would (or even could) pick my private and personal email address to use as a return in a spam mailshot.

I intend to visit all my family/friends machines before the weekend, to eliminate them from my enquiries.

[brianlb]

I have been receiving numerous e-mail notifications that messages I am supposed to have sent are undeliverable: almost all of these have been addressed to ntlworld.com recipients. I have not myself sent any of them. Several have had attachments which have been deleted as infected by Norton AV. Most have been "returned" as undeliverable because the recipient's mailbox is full or its quota has been exceeded -- which suggests that they have been receiving hundreds of virus-initiated messages, some or all of them infected. I receive around 200 spams every day addressed to my ntlworld.com address and around 10 to 15 of these contain viruses (mostly netsky) detected and quarantined by Norton AV. I delete them from my Inbox and from the quarantine folder in Norton.

I have been assuming that as Norton has eliminated all infected files that it has found, the messages supposedly sent from my PC have actually been sent from the PC of someone else who has my ntlworld.com address in his or her address book. But now NTL appears to be saying that the messages have actually come from my PC. A web page has appeared in my browser which appears to come from NTLHome (my ISP is ntlworld.com) containing the following message:
"Virus Infection Alert
You have been redirected to this page because we can see from messages coming from your internet connection that your computer has been infected with the NetSky virus.
This virus will not cause any serious damage, and you may not even know that your PC is infected. However because of the way the virus sends out masses of instructions onto the internet, it is slowing down your connection speed as well as causing congestion on our network, affecting the connection speeds of all our customers, and you must disinfect your computer before we can allow you to connect to the ntl network again.
Your computer can be disinfected and ready to browse the internet again in a few minutes by following this simple process. Please click on the link below to continue."

The NTL web page invited me to download and run a McAfee virus checker (stinger.exe) which I did. Before deciding whether to run stinger.exe, I did a virus scan with Norton AV of my whole hard disk. It found no infected files. I then ran stinger.exe which also didn't find any infected files. I was then able to access other websites.

My Windows XP firewall is activated, I use a dialup connection, and my Windows updates are up to date.

This seems to confirm that the infected messages which pretend to be coming from my PC are in fact coming from someone else's PC that has my e-mail address in its address book. If so, running stinger.exe on my own PC won't stop these messages from going out and I shall soon get blocked again by NTL and forced to run stinger.exe again (it took about 45 minutes to scan my HD). How do I convince NTL that my system is not infected in spite of all these messages going out in my name?

Urgent advice would be welcome!

Brian

[Chris W]

ntl will work out who is sending spam/virus infected mails by ip address, not the name appearing on the email.

Wait and see if you get put back on the walled garden service again.

[Scarlett]

Originally Posted by monkeybreath

ntl will work out who is sending spam/virus infected mails by ip address, not the name appearing on the email.

Wait and see if you get put back on the walled garden service again.

If thats the case then it's probably nothing to do with brianlb, I thought that dialup IP's are assigned dynamically as people logon.

In whcih case the solution provided by NTL of moving that IP to a walled garden area until they have run anti virus stuff is not going work for the dial up subscribers. (might not even work for BB but a BB subscriber is still likely to retain the same IP each day)

[Chris W]

Originally Posted by Scarlett

If thats the case then it's probably nothing to do with brianlb, I thought that dialup IP's are assigned dynamically as people logon.

In whcih case the solution provided by NTL of moving that IP to a walled garden area until they have run anti virus stuff is not going work for the dial up subscribers. (might not even work for BB but a BB subscriber is still likely to retain the same IP each day)

Ah hah... misread that he was a dialup cmr. The ip address from the headers of the emails are checked and the appropriate account that had that ip address at the time is located. I am not excatly sure how the process works for DU cmrs, but i can assure you that there are processes to ensure that the right cmr is put into the walled garden.

[brianlb]

Originally Posted by monkeybreath

Ah hah... misread that he was a dialup cmr. The ip address from the headers of the emails are checked and the appropriate account that had that ip address at the time is located. I am not excatly sure how the process works for DU cmrs, but i can assure you that there are processes to ensure that the right cmr is put into the walled garden.

I'm only a dialup customer because (although I'm in the heart of London) I can't get BB either from BT (the exchange is BB enabled but more than 6 km away) or NTL (which I use for telephone, TV and internet access but which hasn't been upgraded for broadband and seems unlikely ever to be upgraded, since it would cost NTL money...).

But that's another story. For the time being, my internet access has been restored (hence this message!). Watch this space....

Thanks for the comments. I'm still at a loss to know how NTL knows which PC infected messages are coming from if the IP changes every time I dial up. And if they really have a way of identifying the infected PC, why do they tell me that they have detected an infection in my PC when there pretty evidently isn't one? Is puzzlement.

Brian

[BootBoy]

Originally Posted by brianlb

I'm only a dialup customer because (although I'm in the heart of London) I can't get BB either from BT (the exchange is BB enabled but more than 6 km away) or NTL (which I use for telephone, TV and internet access but which hasn't been upgraded for broadband and seems unlikely ever to be upgraded, since it would cost NTL money...).

But that's another story. For the time being, my internet access has been restored (hence this message!). Watch this space....

Thanks for the comments. I'm still at a loss to know how NTL knows which PC infected messages are coming from if the IP changes every time I dial up. And if they really have a way of identifying the infected PC, why do they tell me that they have detected an infection in my PC when there pretty evidently isn't one? Is puzzlement.

Brian

My guess would be that they can match your MAC address to your customer details, in which case you should not have been walled.
If they just wall the IP address (despite it being returned to the pool and re-leased) then there is a problem with the way they identify compromised machines.

Or it could be that the IP was walled while it was leased by the spammer, who then released it and was picked up by you with the restrictions still in place.

I'm guessing.
Perhaps someone who really knows how it works will post a reply.

[Matth]

Dialup modems don't have a mac address - I guess the way they trace it is by the login - presumably the login for each IP address is recorded.