Spamtraphit troubles

tnjfitzy · May 4, 2010

Hi all,

I keep getting these emails from my ISP for something I have no idea about.
I have talked to them and they said it may be a virus or a spambot installed on computer.. I have gone thru with avg ,super antispyware, malwarebytes spybot (s+d) and all the computers/laptops connected to the router (netcomm nb6plus4w) are clean now.
I even changed the security settings and passwords on router as well and still no luck. What else could be causing the problem does anybody know.

below is the email I am getting from them..

Thanks Heaps
tnjfitzy

Dear Customer (*****@tpg.com.au),

Attached is an email that TPG has received complaining about certain
conduct. The IP address and timestamps provided by the complainant
indicate that the conduct occurred over your TPG Service.

IP address: 60.***.***.***
Timestamp (SYD): 2010-05-05 07:37:26

A summary of the last few complaints have also provided below:

[2010-05-05 11:53:44] [Spamtraphit by 60.***.***.*** 2010-05-05 01:53:44 +0000 [noreply]]
[2010-05-05 09:53:07] [Spamtraphit by 60.***.***.*** 2010-05-04 23:53:07 +0000 [noreply]]
[2010-05-05 08:57:07] [Spamtraphit by 60.***.***.*** 2010-05-04 22:57:07 +0000 [noreply]]
[2010-05-05 07:59:58] [Spamtraphit by 60.***.***.*** 2010-05-04 21:59:58 +0000 [noreply]]
[2010-05-05 07:37:26] [Spamtraphit by 60.***.***.*** 2010-05-04 21:37:26 +0000 [noreply]]
[2010-05-05 07:22:57] [Spamtraphit by 60.***.***.*** 2010-05-04 21:22:57 +0000 [noreply]]
[2010-05-05 07:16:55] [Spamtraphit by 60.***.***.*** 2010-05-04 21:16:55 +0000 [noreply]]
[2010-05-05 06:43:17] [Spamtraphit by 60.***.***.*** 2010-05-04 20:43:17 +0000 [noreply]]
[2010-05-05 06:36:56] [Spamtraphit by 60.***.***.*** 2010-05-04 20:36:56 +0000 [noreply]]
[2010-05-05 06:30:29] [Spamtraphit by 60.***.***.*** 2010-05-04 20:30:29 +0000 [noreply]]
[2010-05-05 06:30:29] [Spamtraphit by 60.***.***.*** 2010-05-04 20:30:29 +0000 [noreply]]
[2010-05-05 06:07:42] [Spamtraphit by 60.***.***.*** 2010-05-04 20:07:42 +0000 [noreply]]
[2010-05-05 05:47:21] [Spamtraphit by 60.***.***.*** 2010-05-04 19:47:21 +0000 [noreply]]
[2010-05-04 22:20:58] [Spamtraphit by 60.***.***.*** 2010-05-04 12:20:58 +0000 [noreply]]
[2010-05-03 22:31:31] [Spamtraphit by 60.***.***.*** 2010-05-03 12:31:31 +0000 [noreply]]

TPG does not condone the use of TPG Services for activities which are
offensive, illegal, or infringe on the legal rights of other persons.
Such activities are expressly stated in your agreement with us as being
a basis on which TPG may suspend or terminate the supply of services to
you.

It is alleged in the attached complaint that you, or someone authorised
by you, have engaged in such an activity. If you agree that you did
engage in the activity, please cease it immediately.

If the complaint is about spam, it may be that your equipment has been
compromised by a hacker. Please obtain an up to date antivirus software
and ensure that your machines are cleaned as a matter of urgency. In
the meantime, we have temporarily suspended access to the email server
from your TPG Service to limit the ongoing delivery of spam. If you
fail to stop the spamming from your service and the spam persists, TPG
will take steps to limit the spam on a more permanent basis by either
suspending your service or permanently blocking access to email
servers.

If you have any questions about this email or our Terms and Conditions,
please contact Customer Service on customer_service@tpg.com.au or
13 14 23.

Thank you.

Kind Regards,

Internet Abuse Team
TPG Internet

E-mail: abuse@tpg.com.au
Phone: 13 14 23
Fax: 02 9850 0813

DavidGP · May 5, 2010

Hi

Is that your actual IP address in the report (I know most is 60.*****'d)?

Do you send bulk emails from your multiple PCs, more aiming for is this a business? and maybe using on each email a read/conformation/delivery reply or have any mail filters setup to bounce spam emails back to source.

Was thinking option could be to block port 25 or email outgoing port used on router, dont send any email and see if any PCs trigger a stack of blocked IPs, but you'd have no email until the culprit is found, some info HERE

In majority of cases this does end up being some sneeky malware, so would run the guide below on each PC and then start a new thread for each PC (adding PC #1 at the end of the title) and see if our malware experts can find a cause.

Please read and follow the following READ & RUN ME FIRST. Malware Removal Guide and once finished please start a new thread in the Malware Forum plus a guide on how to attach the logs HOW TO: Attach Items To Your Post
Click to expand...

tnjfitzy · May 5, 2010

Thank for the Reply HALO.

That is my actual IP address according to whatismyip.com

So basically just do a full virus/spyware/malware clean on all the computers and like post the log files of each scan from each PC..

I can post all the Malwarebytes log files if you wish...

Thank again

DavidGP · May 5, 2010

Hi

Best to start afresh and follow the guide I listed above, I know they are not quick steps as in running say just malwarebytes, but they are comprehensive and have some specialist scans that other apps dont do, then yes start a new thread for each PC that you have and name at the end PC#1 PC#2 etc so that the culprit can be easily found, dont post all the logs from the various computers in one thread as it will become confusing. Dont forget to "attach" the logs requested in those new threads.

Just hoping you have not got 100s of PCs or the malware experts here will linch me.

Log in or Sign up

Spamtraphit troubles

tnjfitzy Private E-2

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

tnjfitzy Private E-2

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member