Nigel - I can't send emails and as I don't know your private email address you'll have to put up with this.     You helped me join Eurona on Monday from Iberbanda.  Before you came I sent and received emails as per normal.  In the evening I was able to receive emails but when sending I got an error message that the IP address I was issued with was blacklisted as an originator of spam.

I contacted you and your advice was that I must have a virus or a trojan but I could appeal against the blacklisting and get it lifted.

I did.  It was.

On Thursday night the blacklist was back on.

I appealed.  It was lifted.

I have used every Extermination site I can find to get rid of any unwanted malware and each one shows no infection.

My ISP in UK confirms Eurona issued me the IP address which is causing the problem.

I am totsally unhappy with your assertion that I must have a virus as I understand I would be aware if I was sending multi address spams.  Additionally if, as you assert, I have an infection then it must be sometime during leaving Iberbanded (a slow and expensive but faultless system) and logging on to Eurona. 

I am the innocent party here and I'm looking to you and Eurona to sort out this issue without delay.

RSVP asap.

It's being investigated. If you temporarily switch back to Iberbanda for a couple of days (as it's still running) see if you get blocked there. May be a coincidence. If its the ip being hacked then it will get re-blocked while you are on Iberbanda.

According to Spamhaus the IP is blocked due to an infection of Pushdo which is difficult to detect/remove:
http://www.spyware-techie.com/pushdo-trojan-removal-guide

Nigel - Tks for yours.  I cnfm I am able to send over Iberbanda but when I try to send over Eurona I get the following error message:

QUOTE:An error occurred sending mail: The mail server sent an incorrect greeting:  Your IP address is on the XBL blacklist! Sending denied.
For further information and delisting procedure,
please see http://www.spamhaus.org/query/bl?ip=188.119.192.56.
ENDQUOTE
I further advise I'm unable to send over Eurona from my #2 laptop which has not been used for over 3 weeks ....  so if the #1 was infected at the time of changing companies, the # 2 cannot be.

The fault is undeniably down to Eurona and/or the IP address it has issued me.  A prompt solution will be gratefully received. 

If its blocked then nothing will be able to send. The IP needs to be unblocked first. Then connect #2 and it should be ok. Leave it connected (don't connect #1!) to see if it gets blocked.

Process of elimination to start with. If you get a different IP it may well get blocked as well. What is your Iberbanda IP? (google what's my ip).

Procedure to follow:
1. Unblock IP and don't connect anything for 24 hrs - we can then check if the ip is blocked even without you being connected (can you confirm you have done this).
If it gets blocked it's not you and somewhere it's hijacked.
If it doesn't get blocked then;
2. Only connect #2 and monitor if it gets blocked or not. If not then
3. Connect #1 and monitor. If it gets blocked it's infected.

Eurona have hundreds of IP addresses issued and no reports of hijacking. It's not them blocking you - it's a third party - spamhaus - they are detecting something on your ip address and it should be unique to your connection.

At 03/06-0950: both machines not able to send over Eurona. IP unblocked. Now on Iberbanda, IP= 83.230.189.92.
I'll wait to hear from you before re-connecting to Eurona tomorrow as per your (1).  Phone if you wish. C. 

Check the Iberbanda IP on Spamhaus - it is also blocked but by a different list.

As I write (14:33) the Eurona IP is not blocked.
'It was previously listed, but was removed at 2013-06-03 07:53 GMT'

Will check it again later.

24 hrs on and the ip is still clean. So, connect #2 and see what happens - DON'T us it for mail yet - wait 12 hrs (use it to browse) and check the IP on spamhaus.

Tonight Tuesday 20.00 hrs I can send emails over Iberbanda from both machines.  I get the blacklist message from both machines over Eurona.   Why? 

Why does Iberbanda work perfectly and Eurona doesn't?

Please let me know what you and your company has been doing in the meantime as it appears to me, thus far,  that I am being asked to do all the remedial work.

Spamhaus still says your IP address is clean - it hasn't been blocked since you disconnected your machine.
http://www.spamhaus.org/query/ip/188.119.192.56

So, is it Eurona or your machine??

If it hasn't been blocked while you haven't been connected but does block when you connect what is the deduction? A Eurona problem or a machine problem?

I'm assuming your IP address hasn't changed either on Eurona or Iberbanda but the Iberbanda one IS listed in Spamhaus as violating email sending requirements :
This IP range has been identified by Spamhaus as not meeting our policy for IPs permitted to deliver unauthenticated 'direct-to-mx' email to PBL users
http://www.spamhaus.org/query/ip/83.230.189.92

Connect #2 to the Eurona connection and browse for a few hours then see if the IP is blocked. If not, try it with mail and see if it keeps working.

Process of elimination I'm afraid - and the evidence is pointing to an infected machine. The infection isn't one that is easy to find as it hides itself extremely well and many scanners etc. do not detect it.

I use Avast as my virus checker and hv been onto their problem forum.... the complete dialogue here and you'll find it worth reading ...

http://forum.avast.com/index.php?topic=126424.0

The guy who is mainly involved in my query has 22,000 posts to his name so I assume he has a good knowledge of his product.   To quote him " OK I have found a grand total of two orphaned adware elements and that is it.  No unusual files have been added or modified for the last 30 days.  I do not believe that you are infected". 

I fully believe I have done everything I can do to investigate whether I have an infection as you assert and now, after nearly two weeks of being unable to send emails, I am looking to Eurona for backup.  I don't consider the installation fee of 20 euros has yet been earnt.   Wouldn't a fresh IP address clarify the situation?

Hi ColinB
My experience with blacklisted IP addresses suggests that it can be a frustrating exercise. Some of the blacklists are slow to respond to delisting requests, and therefore it can take some time for an IP to get fully delisted (several weeks in one instance where one of my webservers was concerned).
I don't know how Eurona allocate IP addresses on Wimax connections. If they are dynamically allocated from a pool (likely) rather than being static, then it may be that if you shut down your connection for a period of time (overnight, for example) - i.e. power off your modem box, then when you turn it back on you may be allocated a different IP address from the pool. If so, and your systems are clean, then you'll be home free.
Just a thought.
Good luck with it.

Hello Graham. I'll try anything.  After tonight I'll pull all plugs......certainly worth a try as I'm not getting much support, nor value for money, from Eurona. Thank you for your interest in my problem.

Spamhaus has not blocked your IP for several days (I have been checking regularly 188.119.192.56 so I assume you aren't connected or your IP address has changed and the block is following your machine. What is your current IP address and to which network are you connected?

Thanks Nigel.  I'm now 188.119.192.40 using Eurona and am being blocked.  Continuing to investigate with Avast help desk but nothing to add at the moment.

Your 'old' IP address 118.119.192.56 is still clean - has been since you disconnected from it and stopped sending mail.

Your 'new' IP address has been blocked by Spamhaus. http://cbl.abuseat.org/lookup.cgi?ip=188.119.192.40

So, the problem has followed your machine.

Nigel - if the problem is following my machine then I simply do not understand why I can send emails without difficulty from a wi-fi node in l'Ampolla.  If the machine is infected wouldn't the emails be blocked?

Quite frankly, if I had the chance I would never deal with this company again.  After converting to the upgraded broadband, supposedly at a cheaper rate, I have been consistently overcharged at more than I was paying before.  They now owe me nearly 200€ and Nigel has been unable to get it sorted out.  Nigel has also told me that they do not return money to anyone, just reduce the next bill, but that has not happened.  As a pensioner on a limited budget this is no good to me, I need that money back.  So I have had to resort to Comarcal and they have written to the company for me.  When I get some sort of response I will let you know.

No, your machine isn't blocked, the IP it is connected to however is. If you left your machine connected to the WiFi node long enough then the IP address would presumably be detected by Spamhaus as an infected IP address (or, better described an IP address with an affected machine connected to it) and blocked.  This takes time so it would need to be connected for a while before it was detected.

Did you read through the description of the reason it is being blocked?
http://cbl.abuseat.org/lookup.cgi?ip=188.119.192.40

One possible thing you can try additionally is to force any attempts to send anything to 78.47.46.141 to a dummy IP address. This will only work for that address though and it may change.

This can be done by editing the file:
C:\Windows\System32\drivers\etc\HOSTS and adding the line:

127.0.0.1 78.47.46.141

to the end. The file will look a bit like this:

# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

# localhost name resolution is handled within DNS itself.
#      127.0.0.1       localhost
#      ::1             localhost
127.0.0.1      localhost

And I thoought Catalan was difficult.

wrote on Jun 13^th, 2013 at 9:56pm:

And I thoought Catalan was difficult.

Nigel lost me on the word no ;D

That's strange.  I've just had an email notification of the previous post to this topic and Mailwasher identified it as being Blacklisted by Spamhaus.  Never noticed that before.

Direct quote from the Avast Anti Virus helpdesk follows:



    *****
    Posts: 22652
    Gender: Male
   
        Malware fixes

Re: will Avast find PushDo?
« Reply #19 on: Today at 02:53:39 PM »

    Quote

127.0.0.1 78.47.46.141 this entry will route all your data to a server in Germany .. See screenshot.  I do not understand what he is trying to achieve there as if it is a dummy address then your internet may cease to work


Quote

    It was last detected at 2013-06-08 02:00 GMT (+/- 30 minutes), approximately 6 days, 12 hours, 29 minutes ago.

CBL report.  If you have no problem using hotspots then it is your ISP at fault
Why do they insist on giving a static IP and why will they not change it


Nigel      -     I'm getting very fed up.

It's not a static IP and it has been changed - your original one was different. I don't know what the lease time on the IP is - it may be several days but it does change.

The hosts entry will send anything sent to the 78. IP address (but only this address) to nowhere - it is a way to block sending to certain addresses.

well, last Monday, three weeks after joining up everything cleared and I was able to send emails without any problems.  Most or all consulted authorities agree I did not have any form of infection but my problems were caused by the IP addresses I was given.  It seems that an IP code given to someone in the past can come back to haunt you.....everyone I hsve consulted agree I have not had, now or in the past, an infection.  I am and will remain a little curious as to why one particuar Reputation website, CBL, should single me out whereas a score or more did not find me to be a problem.   The final outcome, Nigel, is that I am really disappointed with your support.  I had to fight my corner all the way with no support from you or Eurona.  I look forward to a competitive supplier.

Glad it's working. Read through the thread. I did everything I could to help. Your IP's were cleaned and monitored by me but I had little feedback from you on results or on what you were doing. I guess you have another IP - hope it doesn't get blocked too. Only time will tell.

As there have been over 1100 visits to this thread I feel I ought to bring things up to date.  After the three weeks or so of having my outgoing emails blocked, suddenly everything returned to normality as reported above and I happily sent emails as normal.   
We have builders in, and some weeks later they switched off everything for over 24 hours.  On resumption of Internet connectivity we found we had been issued a fresh IP address (as one would expect) but when we tried to send an email found we were unable to, as we had been (Oh! You guessed….) blocked.  Again I checked all the internal IP addresses and scanned everything to the deepest available depths without any viruses being detected,  and then opened up an old laptop that hadn’t been used since February this year.  And what a surprise?  Outgoing emails were blocked – proving beyond any doubt my equipment was NOT at fault.  And yes, I did check that routers and modems do not have the same sort of IP address as the emails and so cannot be responsible.  I spoke with Nigel Morton and the Eurona help desk and sometime later normal services were resumed without any feedback, apology or reasons given.
All is well?  Not quite.  Over the last four weeks we have found that on numerous  occasions the Eurona telephone line was dead, even though the Internet worked perfectly.  The only way we know the phone was dead was when someone called on the mobile and said the obvious, or we noticed we had only two lights on the Eurona modem instead of three.  Each time I texted Nigel Morton, and sometime later the line was restored (without feedback so I don’t know if he did in fact do anything).
However, the last time, Saturday, I received the following text from him, “I can’t do any more than advise (you to) reset the equipment as there is a change in the support procedure.  For more support u need to phone Eurona 910444888” (My emphasis) So – if you thought you have local help from your local agent think again.  You will have to phone the help desk and hang on, and hang on - at mobile charges of course as your landline will be dead - Nigel Morton did not elaborate on what the changes are.   
Am I being neurotic in thinking I’m getting a bad deal from these people and why am I  losing an important connectivity?   Unhappily Eurona offers a faster speed at a lower price than Iberbanda….but one has to wonder which gives the better service over all.  And now – dare I turn off the modem for 24 hours and get a new IP address?

This is Spain - no such thing as customer service.
I recently complained to Linea Directa about the attitude of one of their staff. I received a call from the complaints department suggesting it was my fault - unbelievable!
They have no concept of the customer being right, or going that extra mile (or even yard) to help anyone out.

That said, that is usually the large companies, we have had some excellent service from the small local companies.

Maybe you should try the alternatives then you will know for sure whether you are getting the best service and value for money.

PS Nigel has been very helpful to a lot of people on this forum, so I'm not sure you will get much support in calling him.

Telefonica / Iberbanda are terrible companies to deal with.
Even the staff in our bank here, have had problems with them. Our solicitor has a pile of letters and demands, which these companies keep sending out to his clients.
He even told us to ignore any communication from them now!

I think the majority of people find Nigel very helpful.
The Eurona, usually works very well, for most of us.
It does go down sometimes, in bad weather, or if they are doing maintenance work. On the whole it's good.
Could it be something to do with your electricity supply, fluctuating, that causes some problems, maybe?

I have to say Nigel was extremely helpful when I had a recent issue. Kept me informed which I think is good customer service.

I would like to say we have always found Nigel very helpful BUT he does eat all my biscuits upon his visits.
Yours a biscuitless Bulldog. xxx.

Bully, are you saying our Nigel is a rampaging-biscuit case?,if so then there is also another famous biscuit case out there.

http://www.hmrc.gov.uk/manuals/vfoodmanual/vfood6260.htm

Yours,
"Is it a biscuit or a cake?"  Ebrorob    [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif]

---

But....... my comments have not been directed to Nigel himself but the lack of service, feedback and general lack of co-operation from Eurona during my times of crisis.  What has not been explained to me is why I have been blocked and why I lose the phone line - two separate issues and at different times.   

wrote on Aug 28^th, 2013 at 3:12pm:

Bully, are you saying our Nigel is a rampaging-biscuit case?,if so then there is also another famous biscuit case out there. Dear ebrorob, You have forced my hand, our Nige is a biscuit addict, as your forum law enforcement officer with my trusted sidekick Smidge ( co-opted to the job ) he presented me with photographic evidence of Nige's van strewn with empty biscuit wrappers. When Nige confronted with this he stated they belonged to a friend. ( but not Colin B ) who he said in between chompping biscuits was now in re-hab but refused to give a name. The case continues. Your never resting investigating Bulldog. http://www.hmrc.gov.uk/manuals/vfoodmanual/vfood6260.htm Yours, "Is it a biscuit or a cake?"  Ebrorob    [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif] [smiley=2vrolijk_08.gif]

That certainly takes the biscuit Bully.   ;D

Bulldog, I can see you are taking your role as chief of forum police very seriously.  :o