Windows Forum

Ask something
Discussion Locked

Easy points, Spam Tracking.

0 helpful
5 replies

by zk

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,

We've been receiving emails containing virus attachement (from one particular source) lately. We think we're under some sort of attack.

Can you plese tell me who we should chase after? I already did report to admin at networksplus. The host pivilion might be on their nework or relaying from their network. I'm looking more towards confirmation from you.

Our user name is judy@smhco.com. And our email server is exchange.smhco.com.

Thank you.

Full Headers Here ----

Received: from mailhost.networksplus.net (ns1.networksplus.net [199.240.184.2]) by exchange.smhco.com with SMTP (Microsoft Exchange Internet Mail Service Version
5.5.1960.3)
id CYRKDJTN; Wed, 17 Jan 2001 21 :45:39 -0600
Received: from pavilion ([199.240.180.58]) by mailhost.networksplus.net
(Post.Office MTA v3.5.3 release 223 ID# 0-60871U10500L1050S0V35)with SMTP id net for ; Wed, 17 Jan 2001 21:35:50-0600
From: Hahaha
Subject: Snowhite and the Seven Dwarfs -The REAL story!
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--
VEBWL6V4HURO5EVCHEJ41EBKD6ZOXQJCX"

----VEBWL6V4HURO5EVCHEJ41EBKD6ZOXQJCX
Content-Type: text/plain; charset="us-ascii"

----VEBWL6V4HURO5EVCHEJ41EBKD6ZOXQJCX
Content-Type: application/octet-stream; name="dwarf4you.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="dwarf4you.exe"

----VEBWL6V4HURO5EVCHEJ41 EBKD6ZOXQJCX--

5 replies

by bra-k

We too have been hit by this particular email. It has different file names for the attachments. But they are all from the same sender. We have contacted the site sexyfun.net and thier responce is that it does not come from them and that the sender has somehow cloned that email address in order for it to look like it has come from thier server. We unfortunatly have not been able to find the originator, so the only thing we can do is make sure our virus software is up to date and also block the senders email address from coming through our server. We have noticed that the sender is always hahaha@sexyfun.net.

Bra-k

by zk

Initially I thought it was a spam problem. But, turns out, it is a virus problem. Kind of like Melissa and somebody from networksplus is infected with it. The virus info is found at www.sexyfun.net. Thanks for the suggestions.

by turambar386

Here's what I can offer you..

Assuming that mailhost.networksplus.net is trusted, then the email really is originating from 199.240.180.58.

Telnetting to port 25 on that IP address does nothing, so it can be assumed that it is not an unprotected SMTP server that allows relay (unless it is just not in operation right now).

AIRN reports that the IP address belongs to:
MIDnet Operations Center (MIDNET-NOC-ARIN) noc@MID.NET
201 N 8th, Suite 421
Lincoln, NE 68508
US

(402) 436-3060
Fax- (402) 436-3036

The IP address does not have a DNS entry, so its hard to find out anything else about it.

I would try phoning MID.net at the number above and see if you can get anyone's attention there. If not, here is the WHOIS info for MID.net:

MIDnet (MID-DOM)
1820 E. Peters Colony #3701
Carrollton, TX 75007 US

Domain Name: MID.NET

Administrative Contact, Billing Contact:
Bartell, Micah (MB24311) mbartell@CISCO.COM
None3740 Worthington Ave
Lincoln, NE 68502
402.423.7239 (FAX) 402.423.7239
Technical Contact:
Steele, John (JS2554) steele@DFW.NOSTRUM.COM
Mythological Solutions
18081 Midway Rd. #1812
Dallas, TX 75287 972-306-6634 (FAX) 409-260-1101

Record last updated on 28-Oct-2000.
Record expires on 26-Oct-2001.
Record created on 25-Oct-1988.
Database last updated on 22-Jan-2001 07:14:27 EST.

Domain servers in listed order:

DNS.NOSTRUM.COM 216.90.209.254
DNS.DFW.NOSTRUM.COM 207.136.36.6

If you get nowhere with the MID.net NOC, call the administrative contact for the domain name. As it appears to be a CISCO employee, you may get somewhere with them.

Good luck!

by zk

Initially I thought it was a spam problem. But, turns out, it is a virus problem. Kind of like Melissa and somebody from networksplus is infected with it. The virus info is found at www.sexyfun.net. Thanks for the suggestions.

This discussion is closed to new replies.