Zaroba

VDZ · Post by **VDZ** » Thu Oct 21, 2004 9:04 pm

I don't know if YOU know it, but you're sending me viruses. Do you have any trojans?
You sent me 2 viruses so far....
The subjects were both "RE:" and had attachments which obviously were viruses (new_mp3_player.com.exe, LOL).

Mattizme · Post by **Mattizme** » Thu Oct 21, 2004 9:26 pm

Aww, that's nice. That means he likes you! When he starts biting your face, remember your tetanus shot, though.

zaroba · Post by **zaroba** » Thu Oct 21, 2004 10:34 pm

eww, thats yucky.
are they coming from vikingzaroba@hotmail.com? if not, then thier definatly not me. since my old @zarsite.com addresses are gone.

its a new comp with a new instilation of windows with a new and running up-to date McAfee instilation running. will scan and make sure its clean though.

btw, if you can, can you get and post the full header info of the messages?
the senders IP will be listed and i or you can contact thier isp about it. maybe even its somebody we know from here.
it is easy to spoof the From address, just need to set the return path on sent messages to be whatever you want, but the senders ip is intigrated into the e-mail and can't be changed

and thank you for mentioning the situation

i just checked my hotmail and i don't even have your address.

virus scan just finished, no infected files found

hedgehog · Post by **hedgehog** » Fri Oct 22, 2004 2:47 am

a lot of worms nowadays will take the infected user's addressbook and use that as the from field for the outgoing mail.

so it doesn't necessarially mean zar has a virus, but that someone he's emailed at one point in his life who saved his address in their book has a virus.

VDZ · Post by **VDZ** » Fri Oct 22, 2004 5:59 pm

X-Apparently-To: veadezwaan@yahoo.co.uk via 217.12.10.37; Fri, 22 Oct 2004 00:43:18 +0000
X-YahooFilteredBulk: 69.169.161.199
X-Originating-IP: [69.169.161.199]
Return-Path: <zaroba@zarsite.com>
Received: from 69.169.161.199 (HELO home-s9ysy7uj84.net) (69.169.161.199)
by mta109.mail.ukl.yahoo.com with SMTP; Fri, 22 Oct 2004 00:43:18 +0000
Date: Thu, 21 Oct 2004 20:43:16 -0500
To: "Veadezwaan" <veadezwaan@yahoo.co.uk>
From: "Zaroba" <zaroba@zarsite.com>
Subject: Re:
Message-ID: <eqobpbnanigplouzrbv@yahoo.co.uk>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--------xgsemfzzrbmfumcnfuog"

I have no idea what that all means...but if you can read it...

zaroba · Post by **zaroba** » Fri Oct 22, 2004 7:51 pm

well, from that i can tell you the senders IP address is 69.169.161.199
using the ip trace at http://network-tools.com/default.asp?, i can say that the person either changed the ip or its dynamic, since the trace times out. but they live in New York and use Adelphia to connect to the internet.

knowing thier ip address and knowing they use adelphia, this form )http://www.adelphia.net/esafety/abuse_form.cfm) from apelphia.net can be used to report the issue to them and let them deal with thier customer. since they should easily be able to bring up thier DHCP log to see exactly who used that ip address on Fri, 22 Oct 2004 at 00:43:18