AAAARGGHHHHHH!

Issue, I was identified as having sent SPAM

ACTION REQUIRED: Comcast has determined that your computer(s) have been used to send unsolicited email ("spam"), which is generally an indicator of a virus. For your own protection and that of other Comcast customers, we have taken steps to prevent further transmission of spam from your computer(s).

This rendered the IP address that the netgear kept pulling down (no matter what I did) useless.

Once I got the router to release and pull a new IP address all is well, sort of.

Currently, as a sec risk, I cannot send email across port 25...having to change all clients on all machines to a different port assignment.

Should be an interesting call this morning to their risk office to show me what "evidence" there is of this.

In the meantime, I ran spybot and adaware on every machine on the network. There is a possibility of someone hacking the webserver...but they would be hacking ssh which isn't for the faint of heart...plus I have the HD light right in front of me and haven't seen alot of activity.

Any suggestions on how I could be ID'd as a risk...possible that someone spoofed my address and didn't actually send from my machines?...I would think they would be able to tell the difference with that?

of course, the email they sent me said MY computer was sending spam. There was no such evidence of this, they just want everyone to switch to another port.

AND, the issue re-occurred this morning after 12 hours of operating perfectly...and comcast security has no records of any blocks on my account.

Yet the netgear AND linksys router will not connect...actually they connect but I cannot access internet via a router..only direct to machine.

I don't have time to mess with it...meaning I get to spend a 4 day weekend thinking about having this to come back to.

Another problem...while it is good that I have the linksys router to fall back on, my VPN won't connect through it...so I've a feeling I will be at best buy on Tuesday buying yet another router...since there's no way I will get comcast to dispatch someone on this...since I can connect direct from a pc.

Post #288,233 by bepatient 7/3/07 9:56:59 AM Reply	AAAARGGHHHHHH! Pretty sure my Netgear router died. But comcast doesn't make it easy to diagnose, since their handshake is hit or miss even direct to the machine. What a pita. Now I have to figure out this Linksys that came with the vonage. Too much of today's music is fashionable crap dressed as artistry._{Adrian Belew}
Post #288,246 by Andrew Grygus 7/3/07 11:00:39 AM Reply	You mean you had a Netgear router that worked? I just decommissioned another Netgear (VPN model - VPN part not enabled) which wasted more than an hour of my time while moving a new client's office. Turns out it's just not compatible with AT&T's Westel router. DSL worked for about 5 seconds, then stopped. Only a ping direct from a computer would restart the service and the NetGear would instantly stop it again. A Linksys router worked slicker'n snail snot. I don't use Netgear because every time I see it I have to pull it out. Of course that's not quite fair because I'm generally not called in unless something's not working. [link\|http://www.aaxnet.com\|AAx]
Post #288,249 by folkert 7/3/07 11:12:49 AM Reply	Which would be everytime with a Netgear router. I use Linksys or D-Link. But only certain models of D-Link. Linksys seems to be pretty good on all models I have seen. The better things about both the newer Linksys and the D-Link is that they have been doing SPI (Stateful Packet Inspection) on models for a while. Leading to actually mostly understanding SPI. -- [link\|mailto:greg@gregfolkert.net\|greg], [link\|http://www.iwethey.org/ed_curry\|REMEMBER ED CURRY!] @ *i_wethey* `PGP key: 1024D/B524687C 2003-08-05 Fingerprint: E1D3 E3D7 5850 957E FED0 2B3A ED66 6971 B524 687C Alternate Fingerprint: 09F9 1102 9D74 E35B D841 56C5 6356 88C0 Alternate Fingerprint: 455F E104 22CA 29C4 933F 9505 2B79 2AB2`
Post #288,272 by tonytib 7/3/07 7:08:40 PM Reply	Linksys SRX200 is a piece of junk so they do make some bad ones. My older router (a plastic Netgear) worked fine, but I'm happy with a Buffalo as a replacement (and it runs WRT-DDK). --Tony
Post #288,251 by bepatient 7/3/07 11:45:39 AM Reply	flawlessly for many years this is a comcast issue, nearly positive Too much of today's music is fashionable crap dressed as artistry._{Adrian Belew}
Post #288,255 by folkert 7/3/07 11:52:09 AM Reply	SHAME. How DARE... you blame Comcast. -- [link\|mailto:greg@gregfolkert.net\|greg], [link\|http://www.iwethey.org/ed_curry\|REMEMBER ED CURRY!] @ *i_wethey* `PGP key: 1024D/B524687C 2003-08-05 Fingerprint: E1D3 E3D7 5850 957E FED0 2B3A ED66 6971 B524 687C Alternate Fingerprint: 09F9 1102 9D74 E35B D841 56C5 6356 88C0 Alternate Fingerprint: 455F E104 22CA 29C4 933F 9505 2B79 2AB2`
Post #288,258 by bepatient 7/3/07 2:26:24 PM Reply	I know...it can't be...I asked them:-) Too much of today's music is fashionable crap dressed as artistry._{Adrian Belew}
Post #288,262 by folkert 7/3/07 4:27:56 PM Reply	The last time... it was the evil wiring they owned. Therefore NOT caused by them... you living in New Jersey. You see, radiation, chemical contamination and all. This time it must be the evil wiring in your house now. Or maybe someone sabotaged your network with his EVIL Netgear Wireless NIC. -- [link\|mailto:greg@gregfolkert.net\|greg], [link\|http://www.iwethey.org/ed_curry\|REMEMBER ED CURRY!] @ *i_wethey* `PGP key: 1024D/B524687C 2003-08-05 Fingerprint: E1D3 E3D7 5850 957E FED0 2B3A ED66 6971 B524 687C Alternate Fingerprint: 09F9 1102 9D74 E35B D841 56C5 6356 88C0 Alternate Fingerprint: 455F E104 22CA 29C4 933F 9505 2B79 2AB2`
Post #288,250 by folkert 7/3/07 11:20:26 AM Reply	I shoulda brought you my "spare" router. And my spare D-Link 24-port, which runs MUCH cooler than your 3com. -- [link\|mailto:greg@gregfolkert.net\|greg], [link\|http://www.iwethey.org/ed_curry\|REMEMBER ED CURRY!] @ *i_wethey* `PGP key: 1024D/B524687C 2003-08-05 Fingerprint: E1D3 E3D7 5850 957E FED0 2B3A ED66 6971 B524 687C Alternate Fingerprint: 09F9 1102 9D74 E35B D841 56C5 6356 88C0 Alternate Fingerprint: 455F E104 22CA 29C4 933F 9505 2B79 2AB2`
Post #288,252 by bepatient 7/3/07 11:48:53 AM Reply	the 3com does run warm and the fans are annoying...but not nearly as annoying as this issue is getting. I tried the linksys that came with vonage...it was running chained...it won't get an assignment either...with or without mac spoofing. I am reduced at the moment to one machine in the house. Its pissing me off, frankly. But, I've wasted enough time and need to get work done. Too much of today's music is fashionable crap dressed as artistry._{Adrian Belew}
Post #288,323 by bepatient 7/5/07 7:59:06 AM Reply	So I'm a security risk? Issue, I was identified as having sent SPAM ACTION REQUIRED: Comcast has determined that your computer(s) have been used to send unsolicited email ("spam"), which is generally an indicator of a virus. For your own protection and that of other Comcast customers, we have taken steps to prevent further transmission of spam from your computer(s). This rendered the IP address that the netgear kept pulling down (no matter what I did) useless. Once I got the router to release and pull a new IP address all is well, sort of. Currently, as a sec risk, I cannot send email across port 25...having to change all clients on all machines to a different port assignment. Should be an interesting call this morning to their risk office to show me what "evidence" there is of this. In the meantime, I ran spybot and adaware on every machine on the network. There is a possibility of someone hacking the webserver...but they would be hacking ssh which isn't for the faint of heart...plus I have the HD light right in front of me and haven't seen alot of activity. Any suggestions on how I could be ID'd as a risk...possible that someone spoofed my address and didn't actually send from my machines?...I would think they would be able to tell the difference with that? Too much of today's music is fashionable crap dressed as artistry._{Adrian Belew}
Post #288,325 by jake123 7/5/07 8:27:57 AM Reply	You're assuming WAY too much competence they prolly found your IP address in the headers of a spam and, not realising you can only trust the "Received-From" that your own server put in decided to blanket you out. I've run into exactly that situation before. Have fun explaining the finer points of header spoofing to them....
Post #288,326 by boxley 7/5/07 9:05:09 AM Reply	Comcast is one of the last to implement port 25 blocking it appears that you were stuck into a walled garden during this process. Also the ip that you got may have been previously compromised and they havnt cleaned up the list yet. Let me know if they get clueless on you. thanx, bill Quantum materiae materietur marmota monax si marmota monax materiam possit materiari? Any opinions expressed by me are mine alone, posted from my home computer, on my own time as a free american and do not reflect the opinions of any person or company that I have had professional relations with in the past 51 years. meep reach me at [link\|mailto:bill.oxley@cox.net\|mailto:bill.oxley@cox.net]
Post #288,343 by bepatient 7/5/07 2:29:40 PM Reply	The email issue is part of their forced march of course, the email they sent me said MY computer was sending spam. There was no such evidence of this, they just want everyone to switch to another port. AND, the issue re-occurred this morning after 12 hours of operating perfectly...and comcast security has no records of any blocks on my account. Yet the netgear AND linksys router will not connect...actually they connect but I cannot access internet via a router..only direct to machine. I don't have time to mess with it...meaning I get to spend a 4 day weekend thinking about having this to come back to. Another problem...while it is good that I have the linksys router to fall back on, my VPN won't connect through it...so I've a feeling I will be at best buy on Tuesday buying yet another router...since there's no way I will get comcast to dispatch someone on this...since I can connect direct from a pc. Too much of today's music is fashionable crap dressed as artistry._{Adrian Belew}
Post #288,426 by tonytib 7/6/07 8:41:17 PM Reply	That's why I'm glad I have DSL from a small provider
Post #288,429 by folkert 7/6/07 9:53:42 PM Reply	That is also why all of my machines... are configured to use MY mail server, not being in Comcast's control. If I wanted to be told I am sending SPAM, I'd use Windows and their servers. -- [link\|mailto:greg@gregfolkert.net\|greg], [link\|http://www.iwethey.org/ed_curry\|REMEMBER ED CURRY!] @ *i_wethey* `PGP key: 1024D/B524687C 2003-08-05 Fingerprint: E1D3 E3D7 5850 957E FED0 2B3A ED66 6971 B524 687C Alternate Fingerprint: 09F9 1102 9D74 E35B D841 56C5 6356 88C0 Alternate Fingerprint: 455F E104 22CA 29C4 933F 9505 2B79 2AB2`
Post #288,327 by pwhysall 7/5/07 9:20:14 AM Reply	Nit: Spam: From: Mr Charles Ngwi Esquire Subject: I send you this document in order to get your advice SPAM: A not entirely revolting concoction of chopped, spiced and reformed pork and ham, marketed by Hormel foods, who are good enough to not prosecute everyone who uses their trademark as long as you don't put it in all caps. Peter [link\|http://www.no2id.net/\|Don't Let The Terrorists Win] [link\|http://www.kuro5hin.org\|There is no K5 Cabal] [link\|http://guildenstern.dyndns.org\|Home] Use P2P for legitimate purposes! [link\|http://kevan.org/brain.cgi?pwhysall\|A better terminal emulator] [image\|http://i66.photobucket.com/albums/h262/pwhysall/Misc/saveus.png\|0\|Darwinia\|\|]
Post #288,329 by admin 7/5/07 10:00:41 AM Reply	So what's this, then? From: Rear Adm. James Junawi Subject: I send you this chopped, spiced, and reformed pork and ham Regards, -scott anderson "Welcome to Rivendell, Mr. Anderson..."
Post #288,331 by pwhysall 7/5/07 10:34:23 AM Reply	Not beefs, that's for sure. Peter [link\|http://www.no2id.net/\|Don't Let The Terrorists Win] [link\|http://www.kuro5hin.org\|There is no K5 Cabal] [link\|http://guildenstern.dyndns.org\|Home] Use P2P for legitimate purposes! [link\|http://kevan.org/brain.cgi?pwhysall\|A better terminal emulator] [image\|http://i66.photobucket.com/albums/h262/pwhysall/Misc/saveus.png\|0\|Darwinia\|\|]
Post #288,330 by bepatient 7/5/07 10:09:27 AM Reply	Duly noted Too much of today's music is fashionable crap dressed as artistry._{Adrian Belew}
Post #288,334 by folkert 7/5/07 10:53:27 AM Reply	Javascript hole in the Netgear? -- [link\|mailto:greg@gregfolkert.net\|greg], [link\|http://www.iwethey.org/ed_curry\|REMEMBER ED CURRY!] @ *i_wethey* `PGP key: 1024D/B524687C 2003-08-05 Fingerprint: E1D3 E3D7 5850 957E FED0 2B3A ED66 6971 B524 687C Alternate Fingerprint: 09F9 1102 9D74 E35B D841 56C5 6356 88C0 Alternate Fingerprint: 455F E104 22CA 29C4 933F 9505 2B79 2AB2`
Post #288,336 by jbrabeck 7/5/07 11:41:06 AM Reply	This DID happen to me Someone, somehow created a new email account on my computer. And was generating spam from it. I caught it and disabled the account. A new one popped up within minutes. Then I change my email passwords, deleted the account and notified comcast. "must have happened when we merged with time-warner"... Since I've moved I'm no longer with comcast. But while I was, I'd periodically "manage my email accounts" to ensure no new accounts appeared. A positive attitude may not solve all your problems, but it will annoy enough people to make it worth the effort. (Herm Albright)

Welcome to IWETHEY!