Forum Home
Press F1
 
Thread ID: 28750 2002-12-30 04:01:00 Cybercafe Spam with virus csinclair83 (200) Press F1
Post ID Timestamp Content User
109897 2002-12-30 04:01:00 Hi,
I've just received 2 spam mails with virus intention i beleive...
nortons prevented me doing nefing and..i have preveiw in ooutlook and it wont open due to nortons prevention...and i looked in the properties of where the email came from...
it came from a cyber cafe in tauranga...
Is there anyhting i should do? like..email them and ask what their intention was?
or just delete and forget like i do with anything else i get?
this is..i admit..the first ever spam i've ever got located in New Zealand, also...a cybercafe...

this is in properties when i click on where it came from etc......

Return-Path: <mail@cybersurf.co.nz>
Received: from mail.quik.co.nz (203-167-190-11.dsl.clear.net.nz [203.167.190.11])
by ns.quik.co.nz (8.12.5/8.12.5) with SMTP id gBU3lVpl025490
for <csinclair83@man.quik.co.nz>; Mon, 30 Dec 2002 16:47:32 +1300
Message-Id: <200212300347.gBU3lVpl025490@ns.quik.co.nz>
From: Cybersurf.Internet.Cafe, Tauranga, New Zealand<mail@cybersurf.co.nz>
To: csinclair83@man.quik.co.nz
Subject: I am in Love
Date: Mon,30 Dec 2002 16:47:56 PM
X-Mailer: Microsoft Outlook Express 5.50.4133.2400
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary=#r0xx#


Hope someone can tell me what the best action i could do is...nortons couldnt identify the virus in it but, it wont let me open and i wont risk it at all..

Cheers
csinclair83 (200)
109898 2002-12-30 04:15:00 I've encoutered the virus before, Ive got it saved in my hotmail account somewhere, dunno what the name is, but you should just delete it, then inform the cafe that they have a virus and should goto:
http://www.housecall.antivirus.com

Then laugh your head off at them :p
Chilling_Silence (9)
109899 2002-12-30 04:21:00 Sorry.. Ive deleted the messages...

It usually came as Goldfish.eml

It also contained something like

Have a look
Thanks Dear!

In the message, that is if its the one Im thinking of, I might be totally wrong here!
Chilling_Silence (9)
109900 2002-12-30 04:24:00 hi,
check the attached love screensaver
and feel the fragrance of true love..


love.scr is name of the file..
\

thats my email lol...
csinclair83 (200)
109901 2002-12-30 04:28:00 Don't be too quick to jump to conclusions re the sender .

It has in all probability come from someone who has your address in their address bock, and also the cybercafe address . Many Virii simply grab an address at random and spoof it as the "from" address .

The IP may be real, but traceroute simply shows it as an Auckland Telstra Clear address, could be anyone .

I had one recently sent to a little used address on my domain name, purporting to be from the CEO of a NZ company . I knew someone who would have that CEO address, and the e-mail address belonging to my domain, in their address book . One phone call confirmed that they were on-line at the exact time I received the virus email, and investigation showed their PC was infected .

It was not the CEO or his company that had sent it . It was simply someone that had both addresses .
godfather (25)
109902 2002-12-30 04:34:00 Bouncing spam and complaining to ISPs is all very well, but it just uses more network bandwidth . Most of the time it does not affect the culprit .

It's usually best just to dump the stuff and do something useful . (Or even something useless :D , but something you choose to do, not something in response to the malicious scum) .
Graham L (2)
109903 2002-12-30 08:34:00 i've just jumped back online..and received 4 more...but this time 3 of them had a request for a send back 2 sender thingy to say i have readed it...... csinclair83 (200)
109904 2002-12-30 08:52:00 If you are at all suspicious then just delete them.

You could also try mailwasher.

I use Mailwasher, Norton Antivirus 2003 and Norton Internet Security 2002. Outlook 2002 as Email client.

Haven't got a virus yet.
Elephant (599)
109905 2002-12-30 08:59:00 Yep, it'll be a virus that has rearranged the from header. Just as well you had nortons eh! roofus (483)
109906 2002-12-30 20:23:00 Good Morning,
just thought i'd update this..
have woken up to 5 new ones..but this time 2 have come from a friend...
and i honestly dont know anyone in Tauranga...and the the only thing i have entered my email address into lately is EASPorts and to some people at NZOOM.com enquirying about some cricket thing...but i dont think they would give it out to people...

Should I contact the ISP where these emails are coming from and...see whats going on?
csinclair83 (200)
1 2