I am receiving a continuous flood of worm infected mail (Zafi.b). It's
coming in during office hours everyday and Saturday mornings at a rate of
100+ per hour. I have checked the sender's ip address in the header at RIPE
and it tells me that it is assigned to a company on Malta. My mail to their
provider Maltanet and faxes to the company's office get no response. This is
going on for several weeks already. Any advice to stop this?

Thanks, Govert

You are using Outlook Express as a newsreader. Make message rules to delete
those emails and you won't see them any more. If the subject lines have
common words, filter the words in the subject line. You can add words to
your filter after the filter is set. You can also filter on attachment
size, sender name, sending ISP, etc.

It takes less time to set a filter than it does to complain.
##################
(from OE "HELP")

To create a rule for e-mail messages

On the Tools menu, point to Message Rules, and then click Mail.
Message rules cannot be created for IMAP or HTTP e-mail accounts.

If this is the first rule you are creating, proceed to step 3. Otherwise, on
the Mail Rules tab, click New and proceed to step 4.
Select the conditions for your rule by selecting the desired check boxes in
the Conditions section. (You must select at least one condition.)
You can specify multiple conditions for a single rule by selecting more than
one check box. Click the and hyperlink in the Rule Description section to
specify whether all of the rule conditions must be met before the specified
action occurs (and), or whether at least one must be met (or).

Specify the actions for your rule by selecting the desired check boxes in
the Actions section. (You must select at least one condition.)
Click the underlined hyperlinks in the Rule Description section to specify
the conditions or actions for your rule.
You can click contains people or contains specific words in the Rule
Description section to specify the people or words you'd like Outlook
Express to look for in messages. If you enter multiple people or multiple
words per condition, use the Options button in the Select People or Type
Specific Words dialog boxes to further customize the condition.

In the Name of the rule text box, select the default name or type a new name
for your rule, and then click OK.
Notes

You can create a new rule by selecting an existing one on the Message Rules
tab and clicking Copy. This is helpful when the new rule you want to create
is similar to an existing one.
You can create a rule from a message by selecting an e-mail message in the
main window and then on the Message menu clicking Create Rule from Message.
This helps by automatically filling in the name of the person on the From
line; no other information from the message, however, is entered into the
rule.

"Govert J. Knopper" <(E-Mail Removed)> wrote in message
news:40edf7d9$0$158$(E-Mail Removed)...
> I am receiving a continuous flood of worm infected mail (Zafi.b). It's
> coming in during office hours everyday and Saturday mornings at a rate of
> 100+ per hour. I have checked the sender's ip address in the header at
RIPE
> and it tells me that it is assigned to a company on Malta. My mail to
their
> provider Maltanet and faxes to the company's office get no response. This
is
> going on for several weeks already. Any advice to stop this?
>
> Thanks, Govert
>
>

I am using Mailwasher as an intermediate filter and that works fine. But
this flood is choking my mailbox - my ISP's limit seems to be around 260
messages. I really want to stop it at the source.

Thanks, Govert

"Pepperoni" <(E-Mail Removed)> schreef in bericht
news:(E-Mail Removed)...
> You are using Outlook Express as a newsreader. Make message rules to
delete
> those emails and you won't see them any more. If the subject lines have
> common words, filter the words in the subject line. You can add words to
> your filter after the filter is set. You can also filter on attachment
> size, sender name, sending ISP, etc.
>
> It takes less time to set a filter than it does to complain.
> ##################
> (from OE "HELP")
>
> To create a rule for e-mail messages
>
> On the Tools menu, point to Message Rules, and then click Mail.
> Message rules cannot be created for IMAP or HTTP e-mail accounts.
>
> If this is the first rule you are creating, proceed to step 3. Otherwise,
on
> the Mail Rules tab, click New and proceed to step 4.
> Select the conditions for your rule by selecting the desired check boxes
in
> the Conditions section. (You must select at least one condition.)
> You can specify multiple conditions for a single rule by selecting more
than
> one check box. Click the and hyperlink in the Rule Description section to
> specify whether all of the rule conditions must be met before the
specified
> action occurs (and), or whether at least one must be met (or).
>
> Specify the actions for your rule by selecting the desired check boxes in
> the Actions section. (You must select at least one condition.)
> Click the underlined hyperlinks in the Rule Description section to specify
> the conditions or actions for your rule.
> You can click contains people or contains specific words in the Rule
> Description section to specify the people or words you'd like Outlook
> Express to look for in messages. If you enter multiple people or multiple
> words per condition, use the Options button in the Select People or Type
> Specific Words dialog boxes to further customize the condition.
>
> In the Name of the rule text box, select the default name or type a new
name
> for your rule, and then click OK.
> Notes
>
> You can create a new rule by selecting an existing one on the Message
Rules
> tab and clicking Copy. This is helpful when the new rule you want to
create
> is similar to an existing one.
> You can create a rule from a message by selecting an e-mail message in the
> main window and then on the Message menu clicking Create Rule from
Message.
> This helps by automatically filling in the name of the person on the From
> line; no other information from the message, however, is entered into the
> rule.
>
> "Govert J. Knopper" <(E-Mail Removed)> wrote in message
> news:40edf7d9$0$158$(E-Mail Removed)...
> > I am receiving a continuous flood of worm infected mail (Zafi.b). It's
> > coming in during office hours everyday and Saturday mornings at a rate
of
> > 100+ per hour. I have checked the sender's ip address in the header at
> RIPE
> > and it tells me that it is assigned to a company on Malta. My mail to
> their
> > provider Maltanet and faxes to the company's office get no response.
This
> is
> > going on for several weeks already. Any advice to stop this?
> >
> > Thanks, Govert
> >
> >
>
>

On Fri, 09 Jul 2004 12:20:43 +0200, Govert J. Knopper wrote:

> I am using Mailwasher as an intermediate filter and that works fine. But
> this flood is choking my mailbox - my ISP's limit seems to be around 260
> messages. I really want to stop it at the source.


Forget stopping it at the source. Not going to happen. Unless you go over
there and track the idiot down yourself.

Your ISP can stop it at the mail server. Any good ISP will block the IP address
at the server, as long as it is not another mail server. We currently have
hundreds of Virus source IP addresses currently.

J.A. Coutts
**************** REPLY SEPARATER ******************
In article <40edf7d9$0$158$(E-Mail Removed)>,
(E-Mail Removed) says...
>
>I am receiving a continuous flood of worm infected mail (Zafi.b). It's
>coming in during office hours everyday and Saturday mornings at a rate of
>100+ per hour. I have checked the sender's ip address in the header at RIPE
>and it tells me that it is assigned to a company on Malta. My mail to their
>provider Maltanet and faxes to the company's office get no response. This is
>going on for several weeks already. Any advice to stop this?
>
>Thanks, Govert
>
>

Govert J. Knopper wrote:
> I am receiving a continuous flood of worm infected mail (Zafi.b). It's
> coming in during office hours everyday and Saturday mornings at a rate of
> 100+ per hour. I have checked the sender's ip address in the header
at RIPE
> and it tells me that it is assigned to a company on Malta. My mail to
their
> provider Maltanet and faxes to the company's office get no response.
This is
> going on for several weeks already. Any advice to stop this?
>
> Thanks, Govert

Copy and paste the COMPLETE headers into an email and send it to the
IP address in those headers. You MUST send ALL lines of the header for
the ISP to be able to do anthing about it. Just the IP line is not enough.
Read the complete headers here: http://www.spamcop.com

Netuser 58


>
>

On Fri, 9 Jul 2004 03:38:06 +0200, Govert J. Knopper <(E-Mail Removed)> wrote:

> I am receiving a continuous flood of worm infected mail (Zafi.b). It's
> 100+ per hour. I have checked the sender's ip address in the header at RIPE
> and it tells me that it is assigned to a company on Malta. My mail to their
> provider Maltanet and faxes to the company's office get no response. This is

Explain the situation to your isp's abuse desk, and ask them to block all email
from that ip. If it's being sent directly from an infected computer, that should
be the end of it. If it's being sent via the smtp server of the isp, that hosts the
infected computer, it should remain blocked until they explain to your isp, why
they've been ignoring abuse reports.

Regards, Dave Hodgins

--
Change nomail.afraid.org to rogers.com to reply by email.
(nomail.afraid.org has been set up specfically for
use in usenet. Feel free to use it yourself.)