A New Yorker using RoadRunner has a virus...

InvisiBill

InvisiBill

Active member
I just got a Netsky spam from 24.90.153.200, which resolves to nyc.rr.com, spoofing a SyTy address as the sender. You can check your IP with http://www.invisibill.net/ipcheck.php. If you get virus spams like this, you can find the true source by following the steps at http://pctech.invisibill.net/emailsource.html.

Get a virus scanner or update the one you have. AntiVir and AVG are both free programs. http://us.mcafee.com/root/mfs/default.asp, http://housecall.trendmicro.com/housecall/start_corp.asp, and http://www.pandasoftware.com/activescan/ are all free online scanners. http://vil.nai.com/vil/stinger/ is a simple tool that will clean out a few of the major viruses, including this one.

Get a firewall like Kerio so that if you do get a virus, it can't send this crap out.

Note that most variants of this can only infect you if you actually open the file (sometime stored in a passworded zip even) and run it. A few use a really old hole in Outlook to automatically run a program. Either way, patching and a little common sense will stop it.

I'm sure most of you don't care if your computer is sending me all sorts of crap I don't want, but you should...

http://lists.immunitysec.com/pipermail/dailydave/2004-April/000500.html
Of course, no doubt some losers will write the world's dumbest worm
for it though. I wish they'd at least get creative - or fix their hard
drive destruction routines. Maybe they could add it with a spammer
tool that sends out the hard drive first or something. The coolest
worm would probably just send out every spreadsheet and word document,
and then dissapear, and you'd never know you even got hacked. See, now
that's a worm that makes a difference. Destruction isn't bothering
people. Loss of proprietary information and uncertanty makes CEO's
quiver in fear.
Click to expand...

It could just as easily send me anything your PC has access to...
 
InvisiBill

InvisiBill

Active member
Got another one from 24.90.159.166, which is probably the same PC getting a different IP.

And one from 24.8.161.227, though there's nothing SyTy-specific in that one. It's possible they could be from here though. That one's on Comcast.
 
J_SULLIVAN

J_SULLIVAN

A&P slave monkey
I second you on all of the above! :evil: My inbox is full of infected e-mails from names on the BB although maybe not from the same source as yours but still getting very old!
 
InvisiBill

InvisiBill

Active member
Please post the IPs that you got the emails from. Directions are in my "email source" link in the first post.

Pointing out where the problems come from is the best way to get them fixed...
 
J_SULLIVAN

J_SULLIVAN

A&P slave monkey
I'm just going to start putting up the infected e-mail addy's as I get them:
maybe if I do this you smart PC guys can track down who's the bad guy?
 
InvisiBill

InvisiBill

Active member
Syclone 697 said:
I'm just going to start putting up the infected e-mail addy's as I get them:
maybe if I do this you smart PC guys can track down who's the bad guy???
Click to expand...

No, don't post the address. The addresses are all faked. All it does is get people pissed at innocent bystanders. It's just as likely that the email address you posted got a virus email "from" you too.

That's why you need to post the IP. That tells where it really came from.
 
R

Richme

New member
All the spammed emails (virus included) that I receive are from the same place, the email address is spoofed, and they keep changing IP addresses.

Here is one of many that I have received, and here is the info on it according to samspade.org.

4.240.129.223 = [ dialup-4.240.129.223.Dial1.Phoenix1.Level3.net ]
OrgName: Genuity
OrgID: GNTY
Address: Genuity
Address: 225 Presidential Way
City: Woburn
StateProv: MA
PostalCode: 01888
Country: US
NetRange: 4.0.0.0 - 4.255.255.255
CIDR: 4.0.0.0/8
NetName: GNTY-4-0
NetHandle: NET-4-0-0-0-1
Parent:
NetType: Direct Allocation
NameServer: DNSAUTH1.SYS.GTEI.NET
NameServer: DNSAUTH2.SYS.GTEI.NET
NameServer: DNSAUTH3.SYS.GTEI.NET
Comment:
RegDate:
Updated: 2002-05-02
TechHandle: CS15-ARIN
TechName: Soulia Cindy
TechPhone: 1-800-436-8489
TechEmail: csoulia@genuity.net
OrgAbuseHandle: ABUSE23-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: 1-800-436-8489
OrgAbuseEmail: abuse@genuity.com
OrgNOCHandle: NOC119-ARIN
OrgNOCName: NOC
OrgNOCPhone: 1-800-436-8489
OrgNOCEmail: ops@genuity.net
OrgTechHandle: CS15-ARIN
OrgTechName: Soulia Cindy
OrgTechPhone: 1-800-436-8489
OrgTechEmail: csoulia@genuity.net
OrgTechHandle: ARINC4-ARIN
OrgTechName: ARIN Contact
OrgTechPhone: 1-800-436-8489
OrgTechEmail: arin-contact@genuity.com
OrgTechHandle: APL7-ARIN
OrgTechName: ADMIN POC LVLT
OrgTechPhone: 1-877-453-8353
OrgTechEmail: ipaddressing@level3.com
 
You must log in or register to reply here.
Top