Computer help please

[Puckstop31]

Does anyone know if an IP address can be traced by number?

Yes. But when a bug is the source of the message, the IP you see is usually not the actual sender. IP's can be 'spoofed' as well.

The key to catching the actual sender is being able to see the SMTP traffic with a firewall as it is coming in live. If you would share the IP, I could give you a general location of where it was issued.

[Lady's Human]

Norton is an ineffective resource hog.

There are a few free A/V suites that are far better. I hate it when a company lives off of it's reputation for most of the last decade.......In the tech world that should be grounds for going out of business, but much like budweiser, marketing trumps performance and reason.

[krazyaboutkatz]

I also have Norton and it's free with my comcast but it just doesn't do the job in my opinion. I had some problems a while back and Brian,Puckstop31, helped me out again. He recommended that I try Malewarebytes. I tried the free version and it found all kinds of bad things on my computer that Norton had missed. I later bought it and they also have coupon codes that you can find and use too. If you'd like to try it here's a link to the website: http://www.malwarebytes.org/. Good luck.

[Puckstop31]

I also have Norton and it's free with my comcast but it just doesn't do the job in my opinion. I had some problems a while back and Brian,Puckstop31, helped me out again. He recommended that I try Malewarebytes. I tried the free version and it found all kinds of bad things on my computer that Norton had missed. I later bought it and they also have coupon codes that you can find and use too. If you'd like to try it here's a link to the website: http://www.malwarebytes.org/. Good luck.

I use Malwarebytes if the machine already has a bug. Because, IIRC, the free version is not an active scanner, it only scans when you ask it. Part of my job is to try and break the products we use and, so far, I have yet to break through ESET.

Plus, I am just not a big fan of freeware as the front line of defence.

[Catty1]

Freedom, even though the IP is likely spoofed I did a check on ARIN Whois, which sent me to LACNIC.

Apparently the spam originates in Brazil, if this is to be believed.

e-mail: abuse at gvt dot com dot br

You can always send the spam message with all the headers to that address.

I start any searches with ARIN using the last IP address listed "from" (though I didn't do that with yours), and copy and paste the IP address in the upper RH corner here: https://www.arin.net/

It's fun!

[Freedom]

It's fun!

Um . . . OK. (All Greek to me, sorry!)

[Hellow]

If you're talking different A/V software, I use Avast! Antivirus on all of my Windows computers (the two that they are - the majority are Linux and one Mac).

If we're talking email, then here's a funny tip: Almost everything about an email can be spoofed. The way that servers identify if an email is from a spoofed host or not is by taking the IP address that the email originates from and grab the reverse data for it. If the reverse data matches the email's "@whatever.com" address, then it lets it pass. If it doesn't, then it'll probably drop it, or check the domain records of the correct reverse host for the "@whatever.com" domain to see if that mail server is authorized to deliver email for the domain.

The IP address *cannot* be spoofed. That's a server-to-server thing, not something that the sender can control. The IP address is the same address of the sending email server, which isn't something that can be changed with much ease and certainly can't be spoofed by a regular user.

The example in this case:
IP Address: 177.17.118.178
Reverse data for that IP address: 177.17.118.178.static.host.gvt.net.br (by the way, that host doesn't even exist, and "gvt.net.br" sends me to a Portuguese site, so something's iffy)
From address: yahoo.com
Should Yahoo's MX reject it or at least Junk-folder it: Yes.

This is what an actual message from Yahoo should look like:
MX [Mail Server] Non-authoritative answer:
yahoo.com mail exchanger = 1 mta6.am0.yahoodns.net. IP: 66.94.236.34
yahoo.com mail exchanger = 1 mta7.am0.yahoodns.net. IP: 66.94.237.64
yahoo.com mail exchanger = 1 mta5.am0.yahoodns.net. IP: 209.191.88.254

It's really hard for me to tell because Yahoo probably has a God-like amount of email servers (and that's probably just a few) but doing a reverse lookup on an IP should show something.yahoo.com, not what you got above.

I hope this helps you.

This is the fun knowledge that I get from hosting my own email server and doing computer system and network security. It's interesting, to say the least.

[pomtzu]

Um . . . OK. (All Greek to me, sorry!)

Ditto - I'm in the same boat with you, Sandie!

I do know that I had a lot of problems when I was using Norton, and actually paying for it. I've been using the free version of AVG for a couple of years now, and so far, no problems that I am aware of.