Infected PC somehwere - how can I let them know

There's a PC out there somewhere in the internet (well I know in Australia at least), that's infected with a virus. It's sending masses of emails to us and no doubtedly to many others.

In the spirit of trying to help, how could I let the user know they are infected? It's a dynamic IP, but starts at least once a day from the same ISP. e.g. I now know it's current IP address.

I tried to net send, but that seems to not work. I thought it was NetBeui only anyway apparently it's TCP.

Any suggestions? Normally I'd let it slide, but this is beyond a joke now - it's been going on for a month and just recently it seems to have acquired the I-Worm.Bagle.au as well.

All I want to do is get a message to them that they are infected. Although that would look like a scam to me, this person obviously has no clue and would probably do what I tell them.

Contact their ISP?

Yeah forgot to mention I tried that. They didn't want to know.

nmap gave me this:

25/tcp filtered smtp
80/tcp open http
81/tcp open hosts2-ns
111/tcp filtered sunrpc
135/tcp filtered loc-srv
137/tcp filtered netbios-ns
138/tcp filtered netbios-dgm
139/tcp filtered netbios-ssn
161/tcp filtered snmp
162/tcp filtered snmptrap
445/tcp filtered microsoft-ds
593/tcp filtered http-rpc-epmap
635/tcp filtered unknown
1025/tcp open listen
1026/tcp open nterm
3128/tcp filtered squid-http
5000/tcp open fics
6667/tcp filtered irc

Interesting port 25 is filtered. Can't work out what's on port 80 and 81 though.

Just my challenge task for the day

Hmmm, what are the contents of the message? For several weeks I was getting 4-5 virus-laden messages from [email protected] (Blue Cross Blue Shield of Tennessee). I wasn't sure if it was legitimately coming from them or if the address was spoofed.

Don't know exactly since my email server removes virii from emails. It's definitely spoofing email addresses though because I can see from the header it's coming from the the same IP address, but the sender address changes.

Almost all email virii these days are spoofed using addresses stolen from the user's address book.

If you can't find the user specificaly, make the ISP *want* to know. Go to their upstream provider and tell them the ISP is willingly letting a mail attack propagate. When they get their service cut off, they'll care.

Bruno

we had a similar problem a few months ago except we were being Joe Jobbed, with 30% of the mails coming from verifiable Comcast addresses.
In the end we had around 200-300K emails and our external mail system was crawling for a few days.
So far Comcast have yet to reply to our requests.

All it means for us is that next time it happens, we just drop anything from the comcast subnets.

Quote:
In the spirit of trying to help, how could I let the user know they are infected?

In my experience, trying to do this is a self-defeating waste of time. Just make sure your own systems are hardened against viruses and virus emails, and just ignore them.