quote:

---

From abuse@comcast.net
Date Thursday, March 04, 2004 6:48 AM
To [All my comcast emails]
Subject [[Last name, First]] Policy Violation (Spam - Insecure) [TICKET_ID: [#]] {RPTR}:W:

* * * IMMEDIATE ACTION and REPLY REQUIRED * * *Please read this entire message, review the required action(s) below, and send a prompt reply message to acknowledge receipt of this email.From: Comcast Abuse Department [abuse@comcast.net]Comcast has been made aware and verified that a violation of the Comcast Internet Subscriber Agreement and/or Acceptable Use Policy has occurred from your account. These policies can be found at »www.comcast.net/terms. Failure to comply with these policies can result in a permanent termination of your service. The account holder is solely responsible for any and all activities performed from your Comcast service. Please read the following information carefully to ensure that you understand the violation, our policies, and what you need to do to respond to this warning.Type of violation: Unsolicited Email ("spam") originating from your Comcast connectionExplanation:We have confirmed that your machine has been involved in
transmitting unsolicited email, an activity that is in violation of the Comcast Terms of Service Agreement. The reporting parties have provided email header information, which clearly shows the IP address of the computer that was transmitting the email. The IP address listed was one that was assigned to your computer at the date and time in question.******* IF YOU CANNOT ACCOUNT FOR THIS ACTIVITY, THE EMAIL BEING SENT FROM YOUR COMPUTER MAY BE DUE TO A VIRUS/TROJAN INFECTION, A RESULT OF AN INSECURE SERVER, SUCH AS AN OPEN PROXY OR MAIL RELAY, OR A MISCONFIGURED/INSECURE WIRELESS ACCESS POINT ********POSSIBLE CAUSES: (1) Your computer may be infected with a virus, which is trying to spread itself by through email attachments. (2) Your computer may be infected with a virus, which installed an insecure mail server and/or proxy server on your computer. These viruses allow a spammer on the Internet to bounce unsolicited email advertising through your computer and back out
to the Internet. The spam messages would look like they originated from your computer's unique Comcast IP address instead of the spammer's, allowing them to remain anonymous. Please note that if this were occuring, your personal email address would not show up in the "From:" address of the spam messages. (3) You may have intentionally installed a mail server, proxy server, or even a wireless access point that has not been secured, which is vulnerable to relaying of email. (4) You may have a mailing list (e.g. marketing, bulk emailing) that you intentionally send email to, which generated complaints from the recipients.ACTION REQUIRED:(1) Please temporarily remove your computer from the Comcast Internet service if you cannot immediately determine the cause the problem and correct it. This action will protect your computer from being further compromised and protect the Comcast network from receiving further complaints about your account.(2) Remove any viruses and other
illegitimate startup processes from you computer. The best method is to install and/or update commercial antivirus software and run a full scan of your hard drive. Please be aware that some recent viruses can avoid detection by antivirus software, or may not be removed entirely when found. Check with your antivirus vendor to see if it is possible to run the software under Safe Mode for a more complete scan. We would also recommend having the security of your computer reviewed by a third-party computer technician or seek help from your computer manufacturer.(3) Ensure that any servers installed on you home network are NOT accessible from the Internet. It may be necessary to disable, uninstall the services, or in the case of wireless access points, set up encryption (WEP) to protect your network from hijacking.Please reply to this email, keeping the original message and subject unchanged for tracking purposes, upon your receipt of this message. We require your reply to signify
that you have received this message. In some cases, failure to reply can result in account suspension. Further information regarding Internet abuse and security can be found on our web page at »www.comcast.net/terms. This web page also provides links to our Subscriber Agreement and Acceptable Use Policy (AUP); please review these policies should you have any questions or concerns. Related Logs / Evidence:

Email from 24.4.x.x / 16 Feb 2004 23:56:55 -0000
»www.spamcop.net/w3m?i=xxxxxxxxxxxxxxxx

[ Offending message ]
Return-Path:
Delivered-To: x
Received: (qmail 9674 invoked from network); 16 Feb 2004 23:57:29 -0000
Received: from unknown (HELO c60.cesmail.net) (192.168.1.105)
by blade1.cesmail.net with SMTP; 16 Feb 2004 23:57:29 -0000
Received: from mailgate.cesmail.net (216.154.195.36)
by c60.cesmail.net with SMTP; 16 Feb 2004 18:57:28 -0500
Message-Id:
Received: (qmail 12902 invoked from network); 16 Feb 2004 23:57:29 -0000
Received: from unknown (HELO mailgate.cesmail.net) (192.168.1.101)
by mailgate.cesmail.net with SMTP; 16 Feb 2004 23:57:29 -0000
Received: from bluepop.synacor.com [208.197.227.115]
by mailgate.cesmail.net with POP3 (fetchmail-6.2.1)
for x (single-drop); Mon, 16 Feb 2004 18:57:29 -0500 (EST)
Received: via chekdeliver for x; Mon, 16 Feb 2004 18:56:59 -0500 (EST)
Received: (qmail 17091 invoked by uid 0); 16 Feb 2004 23:56:55 -0000
Received: from c-24-4-53-22.client.comcast.net (HELO sender739) (24.4.x.x)
by snowball.synacor.com with SMTP; 16 Feb 2004 23:56:55 -0000
From: a1y0qllJNt@hotmail.com
Subject: Hello,
Content-Type: text/html
Content-Transfer-Encoding: text/html
Date: Mon, 16 Feb 2004 19:00:22 -0800
X-Priority: 3
X-Library: Indy 10.00.14-B
To: x
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-Loop: x
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on blade1
X-Spam-Level: *********************
X-Spam-Status: hits=21.3 tests=BigEvilList_44,DATE_IN_FUTURE_03_06,
FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_TAGS,FROM_HAS_MIXED_NUMS,
FROM_HAS_MIXED_NUMS3,HTML_LINK_CLICK_HERE,HTML_MESSAGE,
HTTP_ESCAPED_HOST,HTTP_EXCESSIVE_ESCAPES,MIME_HTML_NO_CHARSET,
MIME_HTML_ONLY,MSGID_FROM_MTA_HEADER,NO_REAL_NAME,PORN_4,SUB_HELLO,
X_LIBRARY version=2.63
X-SpamCop-Checked: 192.168.1.105 216.154.195.36 192.168.1.101 208.197.227.115 24.4.53.22
X-SpamCop-Disposition: Blocked SpamAssassin=21

Hi!!!... I am really sorry, my website was off limits the other day.

I had problem uploading
my pictures, : )

I finaly got my camera
set up.I am usually
online 24/7.

Anyways, here is
my website, check
it out if you have
few minutes to spare.

homepage people usually say I
look very cute. What do you think?.....

Anyways, I don't want to bore you here any longer...

but i really would like to get in touch.

Candy, *Kiss*,

(<!^_^!>),
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Remove My e-mail
from my Friends
ContactClickHere

--- DO NOT REMOVE TEXT BELOW THIS LINE ---
[##TICKET_ID: xxx] {RPTR}:W:

---

said by flyguy42 :

---

Well... its good to hear that Comcast is taking action and shutting down accounts such as yours.

---

said by Anonymous Coward:

---

I was terminated abruptly without any prior notice. I called the Comcast and after following Reps and (lousy) abuse dept, found out that my pc was sending out spam. They said they would turn back on if I install antivirus+firewall. Well I did and after two weeks, it came back on. Wonderful. Yesterday, (after 3-4 weeks since termination) I received a warning that I will be terminated because my PC was sending out spam (the same spam issue)...

---

said by wheelzoff :

---

I don't believe what I am seeing, they are actually trying to ge rid of zombied machines? HOORAY!!

---

said by BBC News, March 5, 2004:

---

Spammers target home PCs

A huge swathe of net addresses for subscribers of the Comcast US net service was recently put online in a bid to encourage the company to improve its security procedures.

Projects such as MyNetWatchmen and DShield are collating information about attacks and help warn about new threats.

Security firms urge home broadband users to use a firewall and keep anti-virus software up to date to avoid their PC becoming a tool for junk mailers.

---

quote:

---

24.0.102.160 listed in bl.spamcop.net (127.0.0.2)

Since SpamCop started counting, this system has been reported about 12820 times by about 1000 users. It has been sending mail consistently for at least 66.5 days. It has never been listed.

* In the past week, this system has: Been reported as a source of spam about 130 times
* Been detected sending mail to spam traps
* Been witnessed sending mail about 11140 times
»www.spamcop.net/w3m?action=check···.102.160

---

said by wheelzoff :

---

I don't believe what I am seeing, they are actually trying to ge rid of zombied machines? HOORAY!!

---

said by Anonymous Coward:

---

I was terminated abruptly without any prior notice. I called the Comcast and after following Reps and (lousy) abuse dept, found out that my pc was sending out spam.

---

said by Anonymous Coward:

---

I was terminated abruptly without any prior notice. I called the Comcast and after following Reps and (lousy) abuse dept, found out that my pc was sending out spam. They said they would turn back on if I install antivirus+firewall. Well I did and after two weeks, it came back on. Wonderful. Yesterday, (after 3-4 weeks since termination) I received a warning that I will be terminated because my PC was sending out spam (the same spam issue)...

---

said by Anonymous Coward:

---

I was terminated abruptly without any prior notice. I called the Comcast and after following Reps and (lousy) abuse dept, found out that my pc was sending out spam. They said they would turn back on if I install antivirus+firewall. Well I did and after two weeks, it came back on. Wonderful. Yesterday, (after 3-4 weeks since termination) I received a warning that I will be terminated because my PC was sending out spam (the same spam issue)...

---

said by Anonymous Coward:

---

I was terminated abruptly without any prior notice. I called the Comcast and after following Reps and (lousy) abuse dept, found out that my pc was sending out spam. They said they would turn back on if I install antivirus+firewall. Well I did and after two weeks, it came back on. Wonderful. Yesterday, (after 3-4 weeks since termination) I received a warning that I will be terminated because my PC was sending out spam (the same spam issue)...

---