Tracing Web Users

July 17, 2002

More and more I run into the problem of receiving virus infected emails, especially on our business website's email address. It's almost driving me nuts.

Here's the problem....

A lot of users aren't using anti-virus software. That's the biggest problem for ISP's and internet users alike. Lets just say that you're not running any protective software on your machine and you accidentally open up an attachment that was a virus/worm. Probably it is a variant of the klez worm which is extremely rampant right now. Without you knowing it the worm will infect your files, send itself as an attachment in emails to people in your INBOX, as well as to email addresses in your address book and even to people in your SENT ITEMS box! In a random nature. As well it will send these emails with spoofed "from:" sender names using some other email as the message identity.

This makes it a huge headache for everyone else who is protected.

If you happen to receive a virus infected email don't automatically hit the REPLY button and inform them... 95% of the time that email address is faked or belongs to someone else who won't have a clue what you're talking about.

Right click the message and select PROPERTIES, then MESSAGE DETAILS. In there you will find information on who to go after.

I find the following tools useful:

www.visualware.com/emailtrackerpro/index.html Email Tracker Pro using email message header information.
http://visualroute.visualware.com/ Online Visualtrack, find where the offending user is coming from, free.
www.samspade.org/ Free all-purpose tracing, tracking, identifying utility.

I use these tools in combination with each other, then notify the sender if I can (not usually possible) and abuse@theirISP so they can send that person a note to clean their infected computer.

That's all for now, more later!