greystone telecom

jamiex

MickKnipfler wrote:

No, these are really spam. If there is a message it just says "i send you info" or something. all with attachments with extensions I don't recognise. Todays one just had some pictures (that didn't display) and an attachment Attachments00.HQX

The email address was: e2save@greystonetelecom.co.ukHere's the full header:

From e2save Sun May 28 12:30:41 2006
X-Apparently-To: xxxxxxx@yahoo.com via 206.190.48.232; Sun, 28 May 2006 12:30:40 -0700
X-YahooFilteredBulk: 213.106.248.201
X-Originating-IP: [213.106.248.201]
Return-Path: <e2save@greystonetelecom.co.uk>
Authentication-Results: mta224.mail.re4.yahoo.com
from=greystonetelecom.co.uk; domainkeys=neutral (no sig)
Received: from 213.106.248.201 (HELO op01) (213.106.248.201)
by mta224.mail.re4.yahoo.com with SMTP; Sun, 28 May 2006 12:30:34 -0700
From: "e2save" <e2save@greystonetelecom.co.uk>
To: <stexxxxxxx@yahoo.com>
Subject: Fw: Funny
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_NextPart_4.45615768432617E-02"
Content-Length: 120226

You can't really tell anything from this header.

The only thing that proves that it is spam is that the subject is "Fw: Funny " and no legitimate company would send an e-mail like that.

They've probably got the attachment wrong, or peoples' computers are blocking it, because it's most likely supposed to come up with an image showing you their latest deals.

I highly doubt that it is a virus. Virus checkers are always far too cautious and quarantine everything that could potentially contain a virus.

One interesting thing from the header is the IP address that the e-mail was sent from, 213.106.248.201.

I've done a whois lookup and it says:

IP Location: United Kingdom - E 2 Save Ltd
Reverse DNS: host213-106-248-201.no-dns-yet.ntli.net

This could mean that they are using e2save's servers to spam people. If this is the case then they can probably be shut down by sending a polite e-mail to e2save.

E2save's whois lookup is this:

IP: 213.106.248.201
IP Location: United Kingdom - E 2 Save Ltd
Reverse DNS: host213-106-248-202.no-dns-yet.ntli.net

As you can see this is very similar to the company in question.


Hope this helped.

Regards,
Jamie

MickKnipfler

Thanks Jamie.

I do have a phone with E2Save. You don't think it's somebody from within up to do good do you? I can't work out what they're trying to achieve though

yaacov81

well i checked up the attachemnts on google nd they both seem to be viruses.
thanks to mobilemole who tipped me off and helped oput
i am glad i was cautious enough not to open them becuase usuallky i trust emails i get

Mobile_Mole

From the info yaacov81 has given me I reckon this is the W32/Nyxem-D virus. It sends itself out to email addresses harvested from infected machines. The sender's email address is forged.

It does some pretty nasty stuff so if you have opened the attachment I suggest your check your PC ASAP.

For full details see this page on the Sophos website and this BBC article from earlier this year.

Cheers
Mark

MickKnipfler

Thanks Mobile Mole. I haven't opened anything

Sbloomfield

Hi,
I have just found this post whilst searching for links to our company.
I am very sorry you received a virus e-mails. I can assure you Greystone Telecom is an extremely reputable company and will never send spam or viruses.
To ensure we never send viruses we employ a local enterprise antivirus system, as well as screening all inbound & outbound e-mails with a network level antivirus/antispam solution. I can guarantee you would never receive a virus from our network.

The e-mail address e2save@greystonetelecom.co.uk is an address we set up to receive e-mails from e2save which is part of the carphone warehouse group. We do not send e-mail from this address.

For future reference, you can look up IP addresses at www.ripe.net

The address is spoofed. Spoofing is a means that spammers use to appear to be sending from an e-mail address, but it actually originates from another source. This technique is often employed by phishing e-mails.

You may from time to time receive e-mails saying that your e-mail was rejected due to it containing a virus, from someone you didn't send an e-mail to. I do in my yahoo e-mail. This is because your e-mail address is being spoofed! E-mail addresses can be obtained from postings on websites (they gather your e-mail address by using a technique known as web scraping) or an infected PC's e-mail address book.
Tim Berners-Lee inventor of the WWW has written some rules for e-mailing him, these are good general rules to follow for e-mailing people.


Once again, please accept my apologies for the virus e-mail you received.

Kind regards,

Steven Bloomfield
Technical Director
www.greystonetelecom.co.uk