blacklist - whaaat????

[slim tim slide]

on another forum i post on regularly i get the following message every now and again - it lasts about a day and then goes away but during that time i cannot post. the website it leads me to makes no sense to me:

Your IP 78.147.133.138 has been blocked because it is blacklisted. For details please see http://www.spamhaus.org/query/bl?ip=78.147.133.138.

the forum moderators do not know why this is happening. i am certainly not an originator of any spam, and all i am trying to do is post on a forum just like i am doing here.... does anyone have a clue what is going on here and how to stop it???? it happens on firefox & safari... any advice very welcome!

 

[localoid]

Did you read this page?

http://cbl.abuseat.org/lookup.cgi?ip=78.147.133.138

 

[slim tim slide]

Did you read this page?

http://cbl.abuseat.org/lookup.cgi?ip=78.147.133.138

just read it - i must say i am more mystified than ever - what on earth should i do? have i been infected with a trojan or something? how do i get rid of it and prevent it happening again? please advise me - the software they recommend on that page doesn't seem to apply to Mac OSX. I am running OSX10.3.9 by the way.... your help is very much appreciated but i'm lost here!

 

[munkery]

ClamXav has definitions for threats to Mac OS X. Since you are using an older version of the OS you don't have the patches for the few trojans out there. ClamXav is free and should clean your system of the problem if such a threat is an issue. It is more likely something else.

Your IP **.***.***.*** has been blocked because it is blacklisted.

Given that you don't sound security savvy, it is not a good idea to post your ip address.

 

[Me1000]

ClamXav has definitions for threats to Mac OS X. Since you are using an older version of the OS you don't have the patches for the few trojans out there. ClamXav is free and should clean your system of the problem if such a threat is an issue. It is more likely something else.



Given that you don't sound security savvy, it is not a good idea to post your ip address.

Is there a windows machine somewhere on your network? I would blame that long before I would blame an old version of OS X.

Posting your IP address honestly isn't that big of a deal. If someone wants your IP address it wouldn't be hard for them to get. Your IP is stored every time you make a post here, email headers generally have your IP address, etc...

 

[munkery]

Posting your IP address honestly isn't that big of a deal. If someone wants your IP address it wouldn't be hard for them to get. Your IP is stored every time you make a post here, email headers generally have your IP address, etc...

Really? Even with a hardware firewall (router). I thought it would only give the ip for your router. At least that is what I always thought anyway; I would like to know if I am completely wrong about this.

 

[kolax]

Really? Even with a hardware firewall (router). I thought it would only give the ip for your router. At least that is what I always thought anyway; I would like to know if I am completely wrong about this.

Look up WAN and LAN IP's on Wikipedia

 

[mkrishnan]

Agree with the above recommendation to focus on Windows computers (including installations in Bootcamp, Parallels, or VMWare).

Go through each of those computers and make sure that you are...

- Running an up to date antivirus program, that it is set to monitor the system / enabled, and do a full scan also of all physical disks.
- Install and run some kind of malware detector, such as AdAware or Windows Defender.

Now go to all computers, Mac or Windows, that receive e-mail using a program like Mail, Thunderbird, or Outlook, and switch all accounts to SMTP on an authenticated port (usually 587 -- none of your SMTP accounts should be using port 25). This isn't strictly necessary, but it would stop whatever was sending spam through your computers from doing it anymore.

Then, once you did all this, go here:

http://www.spamhaus.org/pbl/query/PBL177874

And follow the directions to remove yourself from the list.

 

[boast]

since it is a dynamic IP, who ever else gets assigned that IP could be the one that is infected. You could try contacting your ISP about it.

 

[mgguy]

since it is a dynamic IP, who ever else gets assigned that IP could be the one that is infected. You could try contacting your ISP about it.

This just happened to me. Last week I got a message from MR saying that my IP had been blocked. I later found out that they blocked me because the IP I used to log in under was used by someone before who did bad things on MR and had to be banned. I apparently have a dynamic IP and by chance got the same IP assigned to me that was used by the other person who was banned. After MR realize the problem they unblocked me. Hopefully this kind of thing is rare.