Printable View
Hi all :)
My ISP suspended my account due to spamming. It looks like I am the innocent party here, I never been involved in spamming. Did someone hack my e-mail address? I have the Norton AVS and zonealarm running, and no viruses were found. I signed up to different ISP now... Any ideas what's going on?s
Without further information it's impossible to answer this.
I know you say the ban is for spam, but have you being doing anything such as port scanning or vunerability profiling from that account. If so that may be the 'real' reason for the ban. What is you ISPs policy about this?
Can you tell us exactly what your ISP has written to you, informing you about this ban. If they haven't told you anything contact them and ask. Once you have the information, contact them and politely explain that this was not done with your knowledge and ask them for you account back and then ask them for their help to prevent this from happening again.
Is your AV up to date with its defrinition files. If not you may have a virus and not know about it. How is zonealarm confgured, since it is possible your computer is compromised and someone has set up your system to spam.
Are you DSL or dial Up
Do you have fixed IP or dynamic
If you are dial-up or dynamic IP its possible that your username and password for your ISP have been compromised, or your PC has been compromised.
Were you running a mail server - If so what was the mail server, and how have you configured it to prevent it from being an open relay.
Have you had any other unusual behaviour from your PC
Wee need more to help.
Steve
Hi
Another couple of questions:
1. is this a PC or a server?
2. Is it always switched on and connected to the net.
If the answer to those is "yes" then you need to check that your setting prevent it being used as a router for the spam?
Cheers
If your ISP gave you any of the mail headers from the SPAM, I would also want to see those as well. Many worms/viruses (especially mail flooders), spoof the sender of the mail to be from people harvested from the infected persons computer. I can't tell you how many times I have had to walk irate, but clueless, admins through the process of examining the mail headers closer to show that they were forged...
Anyway, post them here, with as little changed as possible (I understand if you want to hide your username) and I will have a look at them...
/nebulus
Some ISP's have entire ranges of IP addresses blocked by "Spamhaus.org" (been there - done that !!) You may be in on of those ranges.
I would thing as nebulus200 says....you are most likely infected with something.
Norton/AVG/MCaFee etc don't always catch files that enter through netBios ports 135-139.
(Is file sharing turned on ?)
close all programs and windows then run netstat -an see if you have any listening ports or a connection to 6667. Alot of spammers use infected homeusers as spambots and use IRC to control these spam bots. Aside from 6667 just look for any connection that shouldnt be there. Sometimes virus' arent picked up by any AV cause the signature is not in any AV database.
And please, get a firewall. Do the internet a favor and get a firewall. Spam is evil man, i would ****ing cry if my box was spewing spam.
Thanks for all replies guys :)
Here is the e-mail from ISP about spam:
Subject: UCE: " H()t MHOMS-SALUTvS - fujckL, suvck (incNestS)m"
From: *****@XXXXX.ac.uk (*****)
Date: Fri, 21 Nov 2003 11:35:05 +0000 (GMT)
To: [email protected]
Reported address: XXXXXX
Incident time: 21 Nov 2003 11:42:00 +0000
Logon (utc): 20031121100542
Logoff (utc): 20031121132200
CLI: XXXXXX
DNIS: 142320198333466
Username: *****@bigblue.net.au
bref: GLOBALCEN
cref: GLOBALCEN
Ticket: 42505
I use dial-up to connnect , so I guess its dynamic IP address, have not notice any unusual behaviour lately on PC
I run netstat here are the results:
System 4 0.0.0.0 445 LISTEN UDP
System 4 0.0.0.0 1028 LISTEN TCP
System 4 0.0.0.0 445 LISTEN TCP
lsass.exe 496 0.0.0.0 500 LISTEN UDP C:\WINDOWS\system32\lsass.exe
svchost.exe 656 0.0.0.0 135 LISTEN TCP C:\WINDOWS\system32\svchost.exe
svchost.exe 700 203.23.152.190 2234 LISTEN UDP C:\WINDOWS\System32\svchost.exe
svchost.exe 700 203.23.152.190 123 LISTEN UDP C:\WINDOWS\System32\svchost.exe
svchost.exe 700 127.0.0.1 3003 LISTEN TCP C:\WINDOWS\System32\svchost.exe
svchost.exe 700 127.0.0.1 3002 LISTEN TCP C:\WINDOWS\System32\svchost.exe
svchost.exe 700 0.0.0.0 1025 LISTEN TCP C:\WINDOWS\System32\svchost.exe
svchost.exe 848 0.0.0.0 3060 LISTEN UDP C:\WINDOWS\System32\svchost.exe
svchost.exe 848 0.0.0.0 3059 LISTEN UDP C:\WINDOWS\System32\svchost.exe
svchost.exe 848 0.0.0.0 3037 LISTEN UDP C:\WINDOWS\System32\svchost.exe
svchost.exe 928 203.23.152.190 1900 LISTEN UDP C:\WINDOWS\System32\svchost.exe
svchost.exe 928 0.0.0.0 5000 LISTEN TCP C:\WINDOWS\System32\svchost.exe
alg.exe 1268 127.0.0.1 3001 LISTEN TCP C:\WINDOWS\System32\alg.exe
SAgent2.exe 1284 0.0.0.0 1027 LISTEN TCP C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
SAgent2.exe 1284 0.0.0.0 1026 LISTEN TCP C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
ccApp.exe 1916 127.0.0.1 3004 LISTEN TCP C:\Program Files\Common Files\Symantec Shared\ccApp.exe
msmsgs.exe 3396 203.23.152.190 3361 LISTEN UDP C:\Program Files\Messenger\msmsgs.exe
msmsgs.exe 3396 0.0.0.0 3360 LISTEN UDP C:\Program Files\Messenger\msmsgs.exe
Is this your phone number?Quote:
Logon (utc): 20031121100542
Logoff (utc): 20031121132200
CLI: ************
If not someone knows your password. Is your password a 'strong password' - Mixed case, mixed numbers and letters and not a word in a dictionary. If not it could have been 'brute forced'
Were you really online from 5.42am to 22.00pm - it seems a long time to be online for a dial up. Did you expect to be online for that time. If not this could suggest a number of things.
Forgive me I'm not a windows port expert, but others will comment, I'm sure. Port 1028 might be of interest, and more research into this: http://cert.uni-stuttgart.de/archive.../msg00031.html may be worthwhile.
Is your windows patched and up to date?
Are you sure your virus definitions up to date?
Steve
Edit : Home phone number removed!
Hmmm thats interesting.. I am on dial up and max session is up to 4hr so i its not posssible I was connected for all this time.... the phone no. is correct, windows and virus definitions are up to date.
Antares65 - I've PMed you about this, but it looks like you haven't read it.
Can you edit this post: http://www.antionline.com/showthread...371#post710171 (click the little purple edit box on the top of the post!)
And remove Mr Pollard's email address. He's the person that originally complained about the spam and since you have posted his email address then it is likely to become harvested and he'll receive even more spam.
Steve
edit/
It might also be a good idea to remove the IP Addresses you show, since that may make them become a target for our less than moral readers of these forums.
Steve
Quote:
Originally posted here by steve.milner
Were you really online from 5.42am to 22.00pm - it seems a long time to be online for a dial up. Did you expect to be online for that time. If not this could suggest a number of things.
I may be wrong here but isn't this from 10:05:42 till 13:22:00?Quote:
Logon (utc): 20031121100542
Logoff (utc): 20031121132200
Also make sure you calculate your local time using the correct timezone as these times are UTC.
I am being mega-dense today!Quote:
Originally posted here by SirDice
I may be wrong here but isn't this from 10:05:42 till 13:22:00?
Also make sure you calculate your local time using the correct timezone as these times are UTC.
You are correct.
Steve
It is possible you have been infected by this :http://www.sophos.com/virusinfo/anal...32spybotw.html
You will note in the details it spreads via MSN and kazza and email.
It can also disable antivirus.
Read this and and check out some of the infection symptoms. If this is the case, you could easily have had your account passwords keylogged, as well as anything else you use! If you think you have this, clean it up & change all your passwords for local and online services.
And edit your post that has an email address in it, if not the person that owns it is going to be very very annoyed.
It would be wise to remove your home phone number and IP Addresses as well.
Steve
Ok, sorry, just now saw this. antares65, I think you misunderstood a little about what I meant. When d.e.pollard sent you that email complaining about spam, he should have been able to send you the email he received, with its complete headers intact.
What I want should look something like this:
Quote:
Received: from xx.xx.xx.xx ([xx.xx.xx.xx]) by xxx.xx.xx.xx with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2657.72)
id CZVHLN7P; Mon, 12 Jan 2004 12:07:14 -0600
Return-Path: <[email protected]>
Received: from yy.yy.yy.yy ([yy.yy.28.5] [yy.yy.28.5]) by zz.zz.zz.zz with ESMTP for xxxxxx@xxxxxxxxxxxxx; Mon, 12 Jan 2004 18:07:08 Z
Received: from listserv.ihigh.com (listserv.ihigh.com [63.106.143.29])
by yy.yy.yy.yy (8.12.10/8.12.10) with SMTP id i0CI63SG028136
for <xxxx@xxxxxxxxxxxxxxxxx>; Mon, 12 Jan 2004 12:06:04 -0600 (CST)
Received: (from nobody@localhost)
by listserv.ihigh.com (8.9.3/8.9.3/SuSE Linux 8.9.3-0.1) id MAA19537;
Mon, 12 Jan 2004 12:57:18 -0500
Date: Mon, 12 Jan 2004 12:57:18 -0500
X-Authentication-Warning: listserv.ihigh.com: nobody set sender to [email protected] using -f
To: xxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxx
Subject: WHITE OUT TOMORROW NIGHT
MIME-Version: 1.0
From: [email protected]
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Message-Id: <[email protected]>
This will usually provide enough information to determine who actually sent the spoofed email.
/nebulus
nebulus - I have a feeling that the complaint sent by Mr Pollard was to antares' ISP, not to him.
Steve.
I am sure it was, but his ISP should be able to provide that information, or else they have no justification for revoking his access.Quote:
Originally posted here by steve.milner
nebulus - I have a feeling that the complaint sent by Mr Pollard was to antares' ISP, not to him.
Steve.
/nebulus\
EDIT: Heh heh, just started thinking about the subject of the example email I used, and what that was, was an announcement from my alma mater, to show up to the kentucky basketball game in all white (our school colours are maroon and white) to show team support...just in case anyone was wondering :)
I dont have any more info about Pollard e-mail etc. this is what ISP gave me, but I will contact them to find out more. I run again Norton and 2 other AV scans, installed Adware and Spybot@Destroy and everything looks clean.
How can I check I have the w32spybot virus?
Ps. I edited the previous post. Sorry about that.
Mr. Pollard will go after me for sure now..... :) hope not :D
To check if you have this worm you need to read around the subject, type W32/Spybot- Removal into Google.
A quote by Rybad here http://www.computing.net/security/ww...orum/5902.html
statesSo symptoms include shutting down straight after CTRL-ALT_DEL and an odd EXE in taskmanager msconfig35.exeQuote:
I am pretty sure I have a variation of the W32.Spybot.Worm that infects the task manager and other system tools such as msconfig and regedit, causing them to close automatically. I have all of the same symptoms of this worm (I hit ctrl, alt, delete and it closes by itself no matter what) but Norton DOES NOT detect any viruses. I have done a full system scan twice in safe mode with Norton 2003 completely updated with the latest definitions, and it does not detect anything.
When I looked further into the issue, I noticed when I took a screenshot of my task manager, it shows an odd EXE running called "msconfig35.exe". I also did a search for this file, and found it in the windows prefetch folder and deleted it, but my problems still continue whenever I come out of safe mode and reboot into windows.
I have followed the instructions that were posted on this message board and deleted the registry keys that it instructed but the problem still persists. I have already been to the Symantec removal instruction page for the W32.Spybot.Worm but seeing as Norton cannot find the infection, it doesn't help me.
Does anyone have any information on a possible variation to this infection, and what I can do to get rid of it?
I would appreciate ANY help right now.
I have found this removal tool later on in that thread, which may be of use if you have it.
http://www.trendmicro.com/download/tsc.asp
Steve
Thanks Steve for info . I did a search on Google as well, so far I dont have any of the symptoms regarding W32 Spybot or the above mentioned msconfig35.