Where's Norman ?

[nadamson]

It appears Norman can sell me a solution to my problem, but every email I send him bounces back .

As all I wish to do is spend some money, has anyone got another email address for the Great Master ?

[NormanRouxel]

I'm just opening up my summer house in Turkey (it was a bit too cold in Scotland).

Messages are probably bouncing because someone is sending out a pile of Klez and SoBig worms using my name as one of the return addresses. Some of these are bouncing back to me and filling up my mailbox.

It also seems like it's someone on the Actinic Forum as the attachements, destinations and spoofed from addresses often contain e-commerce related items.

The main culprit seems to be using SMTP servers at comcast.net and attbi.com, so if you're reading this and recognise these servers you may want to check your system.

Norman

[nadamson]

How can I pay you for the enhancements ???

I would like to knuckle down to setting up my first site !!!


Nick

[Scottne]

Norman,

ATTBI was bought out by comcast not too long ago. I'm on attbi at one location but I know for sure it isn't coming from me. I'm pretty careful with viruses and have the latest and greatest from NAV 2003 running on every system.

Comcast is very, very good about tracking this stuff down. About six months ago I was going through something similar. It wasn't intentional but someone had a virus that was sending itself to me dozens of times a day with all different FROM fields. I forward off the email(s) to the abuse line given below and the mails stopped. I don't know how they figured it out, but they did.

Here is the webpage with the email address for attbi/comcast.

http://www.comcast.net/terms/abuse.jsp

[Scottne]

I should also add if this helps to narrow it down:

ATTBI is typically att business internet which means it is coming from someone using high speed business internet. This is somewhat uncommon in New England but much more common in the Southeast US like Florida where it is much cheaper.

ATTBI might also be a home user in some locations.

Comcast servers are not yet being used in New England. If they are coming from these two servers they are coming likely from two different locations of the country.


The previous link I posted should stop it though. If you send them a handful of the bounced emails with a complaint and all the headers. It will likely stop pretty quickly.

Good luck and if you need any more information send me an email.

Thanks

[Jan]

I've had my name associated with a mail carrying the klez virus as well (although I don't have it on any of my machines). It is annoying really but there is nothing you can do about it.

Turkey = cheese boreks IFAIAC.

Regards,