Subject: Virus sent last Thursday - Anyone use RoadRunner?

From: Mark Bakke <[email-masked]>
Date: Tue, 27 Aug 2002 10:36:43 -0500

Sorry this is a bit off-topic, but I want to clear this up.

Last Thursday I had received a lot of email responses from virus
scanning software from recipients on the ips mailing list mentioning
a virus that appeared to be sent by me.  Since I don't use Windows
for email, it seemed odd that I could have sent anything.

It turns out I didn't send it, but I want to figure out where it
came from.

Here's what happened.  The email to the ips list was sent from
a machine at austin.rr.com (RoadRunner), with the From: line set
to my address.  SMTP lets you do this; you can send an email that
appears to be "From:" anyone you want.  Here are the recieve
headers from the machines that sent to majordomo:

Received: 
from sm13.texas.rr.com (sm13.texas.rr.com [24.93.35.40]) by ece.cmu.edu (8.11.0/8.10.2)
with ESMTP id g7N3Koo15994 for <[email-masked]>; Thu, 22 Aug 2002 23:20:51
-0400 (EDT)

Received: 
from Cudhz (cs24243252-119.austin.rr.com [24.243.252.119]) by sm13.texas.rr.com
(8.12.1/8.12.0.Beta16) with SMTP id g7N3OVDg010776 for <[email-masked]>; Thu, 22
Aug 2002 22:24:32 -0500

Does anyone recognize the account or host named cs24243252-119?

Thanks,

-- 
Mark A. Bakke
Cisco Systems
[email-masked]
763.398.1054

---

From: Luben Tuikov <[email-masked]>
Date: Tue, 27 Aug 2002 15:33:58 -0400

> Does anyone recognize the account or host named cs24243252-119?

So it seems that the originating IP is cs24243252-119.austin.rr.com [24.243.252.119].

As of now (Tue Aug 27 15:27:42 EDT 2002) this RR account seems to have
the same IP assigned.

Doing a bit of digging out on arin.net here's what comes up for
CIDR 24.242.0.0/15:

Name:    ServiceCo LLC
Handle:  ZS30-ARIN
Company:
Address: 13241 Woodland Park Road Herndon, VA 20171
Country: US
Comment:
RegDate: 2000-02-23
Updated: 2000-08-16
Phone:   +1-703-345-3416  (Office)
Email:   [email-masked]

So this IP is located somewhere in VA.

Email them at the indicated IP and explain the problem.
You may follow this up with a telephone call if you are not
satisfied with the response you get from the email.

-- 
Luben