New Virus- beware |
Today I received an email claiming to be an 'Internet security update' from Microsoft
As I state in my virus avoidance tips Microsoft never send patches to the public!
If you receive an email like this DO NOT RUN the attached file.
The attached file contains the W32.Gibe@mm
virus which can infect *every* computer on your network if you run it.See W32.Gibe@mm for further details and removal instructions.
The originator of the email I received was "modem-560.cubone.dialup.pol.co.uk ([22.214.171.124] helo=p*****ie)"
This looks to me like a dial up user (hence the 'modem') probably on a dynamic IP address so the sender will no longer be at that IP, so no nuking them OK?
To find out where an email came from and who to send a complaint to, in MS OE you must
right click on the email listed in your inbox, click 'properties'.Select the 'Details' tab and look for where it says "Received from" .
There will be several lines that start like this, they list the route the email has taken in order to get to you.
The last one in the list is normally the actual machine of the sender.
In order to find out who to complain to go to the demon.net network tools page and in the box labelled "Generic Whois Lookup on IP Address" enter the originators IP address,
which in the case of the email I receieved is "126.96.36.199".
The information returned should have a line like "Abuse reports to firstname.lastname@example.org please!"
This is the email address of the abuse department of the offenders ISP.You should send your complaint to them in the following manner:
Rather than clicking'forward',you must copy the full source text of the email you received (missing out the virus itself!)
[ Right click on listed email,click properties, 'details' tab,then 'message source', copy up to just before the attachment starts - it will have something like 'Content-Type: application/x-msdownload;name="q216309.exe" ',
copy to just before this line so that you not resending the virus. ]
Paste this text into a new email to the abuse department.
Please bear in mind that you are writing to the abuse department NOT the person who sent the email. Be polite and they will deal with the matter.
An example letter (the one I have sent) would be :
I received the email below from a computer appearing to be within your IP address block.
The email had an attachment called " q216309.exe" which was 124Kb in size.
I believe it may be a virus, as I very much doubt Microsoft would send me a security patch
I have included the full source of the email below.
[include the source text here]
The abuse dept may or may not reply.
The person who sent the virus may be contacted by their ISP and informed ofthe complaint against them.
The originator may not have sent the virus deliberately, but could be infected and the virus may be using their PC to spread itself around.
A free virus checker is available from www.norton.com
Article by J.P.Lee Bsc(Hon's)