Email viruses

[kirsty]

I've been getting viruses sent to me for a few weeks now, to both my Bluyonder email addresses and my website email addresses.

All from the same IP, all blocked by my AV software.

The question is, how can I block this IP from emailing me?

The virus is the WIN32 Sober worm and I am in no doubt that the sender doesn't know their pc is infected.

I have emailed the 'Abuse' email address found via a 'whois' query, but to no effect.

[pet121]

The old email virus issue. Instead of tracking down the person its originating from just block the email address from whatever email program you use. If they are sending attachments like a zip folder and you really want to view it, scan it first for viruses. But the generel practice is don't open anything you are not familiar with. If its a person's computer infected with a virus tell them about it. What I do if I find the virus was sent on purpose I usually send them something in return. pet121

Fish swimming with sharks usually get eaten!

[kirsty]

Strangely enough, we haven't had any for about 12hours now......

But... I couldn't find an originators email address, all I could get was an IP address...

Do people realise they're infected and sort it? Or do the viruses 'expire'?
Just seems weird we had them being sent (from the same IP) for a week or 2, and they suddenly stop.

thanks for the reply

[pet121]

Viruses don't expire unless you get rid of them off your computer. An Ip address is better to have. once you aquire the skills people can inflict retribution with a IP address. I don't suggest this approach however. I wounldn't worry about it to much just use your anti virus software. pet121

[kirsty]

Spoke too soon it seems... lol... just had another one through.
I'm not into retribution because it's almost certainly someone whose pc is infected without their knowledge.

When I view the message source, this is what I get (I don't think I'm posting any sensitive info, or breaking any etiquette - but please tell me if I am).....

Return-path: <Post@fbi.gov>
Envelope-to: admin@american-bulldog.co.uk
Delivery-date: Wed, 07 Dec 2005 08:36:25 -0600
Received: from [72.4.4.104] (helo=uykiwxo.gov)
by voda3.vodahost.com with smtp (Exim 4.52)
id 1Ek0PA-0002al-N1; Wed, 07 Dec 2005 08:36:24 -0600
From: Post@fbi.gov
To: MailIn_Box@american-bulldog.co.uk
Date: Wed, 07 Dec 2005 14:36:11 GMT
Subject: [avast! - INFECTED] Your_IP_was_logged
Importance: Normal
X-Priority: 3 (Normal)
Message-ID: <e36ec5a1fe8964845e@american-bulldog.co.uk>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="9caddc01c760cc722"
Content-Transfer-Encoding: 7bit
X-Antivirus: avast! (VPS 0549-3, 07/12/2005), Inbound message
X-Antivirus-Status: Infected
Attachment: \question_list.zip#3246972437 Virus: Win32:Sober-AB2 [Wrm] Deleted

[pet121]

I wouldn't lose any sleep over this. Who ever is sending you this stuff just delete it. I can't understand if someone is sending you a zip file I would assume they know it contains a virus. win32:sober is pretty harmless but can still cause problems over the long run.

As far as retribution goes, if I get stabbed in the back I always stab back. How this is done is a secret. I can't stand people who cause other people problems on the net. I have been doing this to long to just stand by and take it anymore. I will hunt them down. pet121


P.S. After having a closer look the sender knows its a virus. Its just some yahooly playing around with you. The email it originates from is covert meanning covered.