e-mail virus - recourse?

[brheault]

I am continually receiving infected e-mail (W32/Mimail.c@MM) from a PC from a University domain. I have informed the webmaster/abuse of said domain numerous times, yet they do not seem concerned in the least and have done nothing to block this infected PC from sending me infected e-mail.
I know it would be a simple matter to simply block the sender from my e-mail, but it is the fact that they seem to care nothing or willing to do anything about this infected PC broadcasting virus everywhere. This has been going on for about 8 weeks.
What other recourse do I have to fight back?

 

[2ffat]

Are you sure that the sending computer is really the infected computer? According to Sophos, "W32/Mimail-C spoofs the From field of the sent emails . . ."


James P. Cottingham

^{There's no place like 127.0.0.1.
There's no place like 127.0.0.1.}

 

[brheault]

The header information indicates the mail originated behind university's mail server. You are right about the spoofed From: field, though. The From: field uses a return address in our own domain.

I did send the university a copy of the email very early on and they admitted it was from their domain, but that was over 8 weeks ago and after that continue to ignore my pleas to look into shutting down or cleaning the machine.

I want to know who I can contact to nudge them to cleaning this machine. It seems highly irresponsible to me that they are ignoring such a small, but potentially very damaging, problem.

Are there legal reprecussions that they knowingly are allowing this virus to propagate unstopped?

Brian Rheault

 

[2ffat]

As far as legal ramifications, you have to check with a lawyer. The law varies widely from country to country, state to state, and even city to city.

Have you talked to the someone in charge at the university? A Provost, President, etc.? Some universities have some sort of omnibudsman to handle complaints against the university. Since the webmaster won't do anything (could be a student), the best thing is to "light a fire" under someone in charge.

Just my two cents worth.


James P. Cottingham

^{There's no place like 127.0.0.1.
There's no place like 127.0.0.1.}

 

[SESaskDFC]

Howdy:

Personally, I would file a complaint with the Universities ISP.. The Univ. would look pretty follish if they had their email server/service discontinued doe to a lack of support concerning the propogation of virii !!

Murray

 

[brheault]

I have contacted the person listed in their WHOIS entry, and CC'ed numerous other PC help addresses I found on the external Web site.

Murray, mentions following up with their ISP. How can I find out who their ISP is?

Brian

 

[wbg34]

If their website has a technology section, then see if it lists their staff (many Universities do and they include e-mail addresses). Send a letter to the technology department head and cc the person listed in their whois entry. If that list doesn't exist, then look on the administration part of the website and send an e-mail to the President or to the VP responsible for the technology department.

 

[glacierxx]

I am a Security Engineer with a large network and we deal with ISP's on a daily basis. What you are encountering is very close to the norm. There are a few ISP who will assist but most are customer oriented and there purpose is to supply a service to those who pay them (pay being the key word) As long as it is not affecting them, they really don't care. With that said, there are those out there who are proactive and willing to help. Our world of computers can be a frustrating one. I have placed subject line blocks for all variants of the Mimail worm at the gateways just to keep them out of our enterprise.

"evil prospers when good men do nothing”