| Grex > Agora46 > #44: Strange email |
| response 50 of 71: | 
Aug 21 02:23 UTC 2003 |
I have been getting about five a day for three days.
| response 51 of 71: |
Aug 21 02:58 UTC 2003 |
Right, I'm on Linux too, so I doubt I'm infected, or that the removal tool is executable on my machine.
| response 52 of 71: |
Aug 21 05:00 UTC 2003 |
Yep, probably sobig.f bounce messages from email sent from an infested machine that you are in the address book of. One org who had to split its smtp mta onto a separate machine from the lotus notes cluster reports 70% of inbound smtp email to be sobig.f propagation attempts. It couldn't have happened at a better time, not! Thank bill.
| response 53 of 71: |
Aug 21 17:44 UTC 2003 |
This response has been erased.
| response 54 of 71: |
Aug 21 20:40 UTC 2003 |
According to the Milwaukee Sentinel, CSX Railroad has shut down train service due to the Sobig virus, which essentially shut down their communications net.
| response 55 of 71: |
Aug 21 20:44 UTC 2003 |
Last I checked, I had over 5,000 virus emails (presumably mostly Sobig), and hundreds of bounce messages, both from undeliverable messages and from virus detection screens on all kinds of systems. Maybe one of these days, authors of the antivirus programs will realize that it no longer makes any sense to send replies to forged "From:" headers. I got quite a few of these for the Klez virus, which also forged From: lines, but this attack seems to be tremendously larger. I think the last major virus which revealed the victim's name in the origin of the virus messages was SirCam.
| response 56 of 71: |
Aug 22 13:28 UTC 2003 |
SirCam was fun because you got a random document off someone else's machine with each copy. ;>
| response 57 of 71: |
Aug 24 22:53 UTC 2003 |
Re 56. Yes, but it was somehow encrypted; I couldn't see how to read the file without running the virus.
| response 58 of 71: |
Aug 25 12:58 UTC 2003 |
If I remember right, the virus code was just tacked on the beginning, a bit like a Zip self-extractor. If you knew how long it was you could strip it off. I never tried it, but I know other people did.
| response 59 of 71: |
Aug 26 18:01 UTC 2003 |
Re #39ff: I have tried to use the filter function in pine, on CAEN, with very weird results. I filtered only on the Subject line of Email, with a comma-delimited list of "patterns", with the action delete. That resulted in my INBOX being emptied of *everything*. I finally figured out how to specify a destination folder, which put some messages there, but including some that did not have the filter patterns. I fiddled some more with it, with the result that when I opened the sent-file folder, it moved *eveything* in it to the filter destination folder. I've turned the whole filter thing off (I hope...) before it wipes all my e-mail folders clean. Unfortunately, the HELP function for the pine filter is written for those that wrote it, not for newcomers to it.
| response 60 of 71: |
Aug 28 06:54 UTC 2003 |
From Riyaz_Brett@cis.net Thu Aug 28 02:48:38 2003 Date: Thu, 28 Aug 2003 15:49:11 -0400 (EST) From: Kylie Zachary <Riyaz_Brett@cis.net> To: ranecurl@umich.edu Subject: Buy drugs, Heroin, Tomohawk rockets, cocaine and other shit Welcome to the site http://www.darkprofits.com, it's us again, now we extended our offerings, here is a list: 1. Heroin, in liquid and crystal form. 2. Rocket fuel and Tomohawk rockets (serious enquiries only). 3. Other rockets (Air-to-Air), orders in batches of 10. 4. New shipment of cocaine has arrived, buy 9 grams and get 10th for free. 5. We also offer gay-slaves for sale, we offer only such service on the NET, you can choose the one you like, then get straight to business. 6. Fake currencies, such as Euros and US dollars, prices would match competition. 7. Also, as always, we offer widest range of child pornography and exclusive lolita galleries, to keep out clients busy. Everyone is welcome, be it in States or any other place worldwide. ATTENTION. Clearance offer. Buy 30 grams of heroin, get 5 free. Prepay your batch of rockets (air-to-air) and recieve a portable rocket-lacuncher for free. http://www.darkprofits.com This offer won't last! Only until 20th of August all our clients will also recieve a pack of 2 CDs, with best selection of child pornography.
| response 61 of 71: |
Aug 28 12:52 UTC 2003 |
I got that one today, too.
| response 62 of 71: |
Aug 28 12:54 UTC 2003 |
Hmm. I visited the site and it's actually a web discussion board about online anonymity. Interesting.
| response 63 of 71: |
Aug 28 15:47 UTC 2003 |
A really amazing example of the use of comment tags to break up spam text.
Note also that the From: line is forged to be the same user name as the
recipient.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Return-Path: <Polygon@earthlink.net>
Received: from nellys-deals.org ([61.154.118.6])
by hamjudo.com (8.12.6/8.12.6/Debian-7) with SMTP id h7J9ZsM8025591
for <polygon@potifos.com>; Tue, 19 Aug 2003 05:36:00 -0400
Received: from nellys-deals.org by r1pwumsnl3ck90.nellys-deals.org with
SMTP for polygon@potifos.com; Tue, 19 Aug 2003 05:35:18 -0500
Date: Tue, 19 Aug 2003 05:35:18 -0500
Content-Type: text/html; charset=iso-8859-1
From: Polygon@earthlink.net
Content-Transfer-Encoding: 8BIT
Message-Id: <3eqa9x.8l07tb2e5gko5q.Polygon@earthlink.net>
Subject:
To: polygon@potifos.com
X-MSMail-Priority: Normal
<html><body><br><br>Yo<!--Very well, very well, said the major, who was in
ecstasy -->ur requ<!--Very well, very well, said the major, who was in
ecstasy -->ested - ha<!--Very well, very well, said the major, who was in
ecstasy -->nd cra<!--Very well, very well, said the major, who was in
ecstasy -->fted ti<!--Very well, very well, said the major, who was in
ecstasy -->mepie<!--Very well, very well, said the major, who was in
ecstasy -->ces. <br><br>Y<!--Very well, very well, said the major, who was
in ecstasy -->ou m<!--Very well, very well, said the major, who was in
ecstasy -->ay al<!--Very well, very well, said the major, who was in
ecstasy -->so b<!--Very well, very well, said the major, who was in
ecstasy -->e inte<!--Very well, very well, said the major, who was in
ecstasy -->rested ov<!--Very well, very well, said the major, who was in
ecstasy -->er 2<!--Very well, very well, said the major, who was in
ecstasy -->0 br<!--Very well, very well, said the major, who was in
ecstasy -->ands avai<!--Very well, very well, said the major, who was in
ecstasy -->lable i<!--Very well, very well, said the major, who was in
ecstasy -->n o<!--Very well, very well, said the major, who was in ecstasy
-->ur wi<!--Very well, very well, said the major, who was in ecstasy -->de
sel<!--Very well, very well, said the major, who was in ecstasy -->ection
a<!--Very well, very well, said the major, who was in ecstasy -->s
we<!--Very well, very well, said the major, who was in ecstasy
-->ll<br><br><a href ="http://www.flight-place.biz">Ple<!--Very well, very
well, said the major, who was in ecstasy -->ase vi<!--Very well, very
well, said the major, who was in ecstasy -->ew ou<!--Very well, very well,
said the major, who was in ecstasy -->r lar<!--Very well, very well, said
the major, who was in ecstasy -->ge selec<!--Very well, very well, said
the major, who was in ecstasy -->tion b<!--Very well, very well, said the
major, who was in ecstasy -->y clic<!--Very well, very well, said the
major, who was in ecstasy -->king he<!--Very well, very well, said the
major, who was in ecstasy -->re no<!--Very well, very well, said the
major, who was in ecstasy -->w.</a><br><br>W<!--Very well, very well, said
the major, who was in ecstasy -->e lo<!--Very well, very well, said the
major, who was in ecstasy -->ok for<!--Very well, very well, said the
major, who was in ecstasy -->ward to spe<!--Very well, very well, said the
major, who was in ecstasy -->aking wi<!--Very well, very well, said the
major, who was in ecstasy -->th y<!--Very well, very well, said the major,
who was in ecstasy -->ou.<Br><BR>Of<!--Very well, very well, said the
major, who was in ecstasy -->f Li<!--Very well, very well, said the major,
who was in ecstasy -->st <a href ="http://www.flight-place.biz">Here </a>
Th<!--Very well, very well, said the major, who was in ecstasy -->ank
y<!--Very well, very well, said the major, who was in ecstasy
-->ou.<br><BR><br></body></html>
| response 64 of 71: |
Aug 28 15:51 UTC 2003 |
This one is odd for different reasons. The original text was in three
languages; only the English section is included below.
---------- Forwarded message ----------
Return-Path: <MAILER-DAEMON@bacon.hamjudo.com>
Received: from TmpStr (adsl-80-4-244.mia.bellsouth.net [65.80.4.244])
by hamjudo.com (8.12.6/8.12.6/Debian-7) with SMTP id h7RHZLM8001726
for <polygon@potifos.com>; Wed, 27 Aug 2003 13:35:25 -0400
Message-Id: <200308271735.h7RHZLM8001726@bacon.hamjudo.com>
Reply-To: "PANAMERICAN SEMINARY"<>
From: "PANAMERICAN SEMINARY"<>
To: "Lawrence Kestenbaum" <polygon@potifos.com>
Organization:
X-Priority: 3
X-MSMail-Priority: Normal
Subject:
Sender: "PANAMERICAN SEMINARY"<>
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Date: Sat, 2 Aug 2003 13:34:46 -0700
Panamerican Seminary
4081 N. Federal Hwy
Suite 120-B
Pompano Beach, FL USA 33064
Phone: (954) 941 9975
Dear brother or sister in Christ,
Analyzing the necessity of theological formation of many workers of God
and, on the other hand, the difficulty that many of you have to attend
regular classes in a regular seminary, we elaborate some long-distance
courses, through the system of open university to take care of similar
demands like these.
After a lot of work and based upon the courses that are given by the
universities of Phoenix, Devry, Salamanca, London and others of
Europe, we create the course of Bachelor in Theology through the
system of notorious knowledge.
This system has the advantage to use the knowledge that you already
have acquired in your evangelical tasks, in your studies, in the teaching
of the Word, in Bible schools and, even though in the preparation and
delivery of sermons.
The method is original. Although you will not receive theological
information, you will receive the theological formation that you need.
How? Proving that you know what you know. We deliver to you a book
of 104 pages with designed tests of 45 different subjects, many of them
purely biblical and others theological ones, by the system of multiple
choice or "false or true". Your course can be sent in any of these three
languages: English, Spanish or Portuguese. Please, make us know in
which language you want your course.
After you answer the questions in the sheets of answers, you will send
them so that we make the evaluation. If you obtain at least grade 6,0 in
each subject and general average 7,0, you will be duly graduated. At any
time of the year when you finish your course, you will receive your diploma
immediately but, if you are willing to attend the graduation ceremony in the
end of the year, here in the United States, at South Florida, it will be very
important for the record of your life.
After a lot of planning, we concluded that although the course worth a lot
more, we will request only the payment of US$210.00 (two hundred and
ten American dollars). In any other theological course you would have to
spend two, three or four years and would pay the amount of two to seven
thousand dollars.
Now, a good notice: you can pay your course through monthly
installments of one hundred dollars. The first payment of US$70.00
(seventy dollars) must be made in advance and the other payments in the
next two months.
The payments can be made by check to the order of Stardel Inc., from
anywhere in the world. If you prefer, send a money order or any other
way that you choose. You write your check in the currency of your
country with the equivalent value.
As soon as we receive your check, we will send your academic material
and we will be wishing all the success of the world for you. Take the time
you need. We do not place any limitation to your work.
We have all the confidence, dear brother or dear sister, that God will
bless you in a special way, with the achievement of this course that will
be a great victory in your life. Please send your answers by mail to the
following address:
Panamerican Seminary
4081 N. Federal Hwy
Suite 120-B
Pompano Beach, FL USA 33064
Phone: (954) 941 9975
The Lord bless you!
Dr. Paulo de Aragão Lins, Director
| response 65 of 71: |
Aug 28 15:56 UTC 2003 |
And here's the latest manifestation of the warp drive spam (paragraphs
reformatted):
Still not at all sure whether this is generated by an insane or deluded
person, or whether it's essentially a null message sent out by spammers to
check addresses.
---------- Forwarded message ----------
Return-Path: <dr@bahn.de>
Received: from HSY ([218.17.251.21])
by hamjudo.com (8.12.6/8.12.6/Debian-7) with SMTP id h749eoc5021377
for <polygon@potifos.com>; Mon, 4 Aug 2003 05:41:13 -0400
Received: from kvk.r6e1.org [223.245.57.136] by HSY with ESMTP id
<543488-29042>; Mon, 04 Aug 2003 06:41:16 -0700
Message-ID: <n$hh98208o---2e77ny-5--$n23$a@65nut.mr3e>
From: "" <dr@bahn.de>
To: <polygon@potifos.com>
Subject: Dimensional warp Generator Needed qg ujwaizpmg
Date: Mon, 04 Aug 03 06:41:16 GMT
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2462.0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="7_C85..B_C_24ED99.9"
Hello,
I'm a time traveler stuck here in 2003. Upon arriving here my dimensional
warp generator stopped working. I trusted a company here by the name of
LLC Lasers to repair my Generation 3 52 4350A watch unit, and they fled on
me. I am going to need a new DWG unit, prefereably the rechargeable AMD
wrist watch model with the GRC79 induction motor, four I80200 warp
stabilizers, 512GB of SRAM and the menu driven GUI with front panel XID
display.
I will take whatever model you have in stock, as long as its received
certification for being safe on carbon based life forms.
In terms of payment:
I dont have any Galactic Credits left. Payment can be made in platinum
gold or 2003 currency upon safe delivery of unit.
Please transport unit in either a brown paper bag or box to below
coordinates on Monday August 4th at (exactly 3:00pm) Eastern Standard Time
on the dot. A few minutes prior will be ok, but it cannot be after. If you
miss this timeframe please email me.
Latitude N 42.47935 & Longitude W 071.17355 and the Elevation is 119.
WARNING: DO NOT ATTEMPT TO TRANSPORT ITEM BY REGULAR MEANS OF
TELEPORTATION. THEY ARE MONITORING AND WILL REDIRECT THE SIGNAL!! I DO
NOT CARE HOW YOU HAVE TO GET IT HERE, JUST DO IT IN A WAY THAT NO SPYING
EYES WILL POSSIBLY BE ABLE TO REDIRECT THE TRANSFERENCE. IT IS VERY
IMPORTANT THAT YOU BE ABLE TO MONITOR THE TRANSFER.
Although those coordinates are a secure guarded area, these channels
through email are never secure. Unfortunately it is the only form of
communication I have right now.
After unit has been sent please email me at: info@federalfundingprogram.com
with payment instructions. Do not reply directly back to this email.
Thank You
groancjyoqv le ilw uxx
| response 66 of 71: |
Aug 28 16:54 UTC 2003 |
re 63 Well, it would break the filter that coould look and see if the proportion of 'x', 'y', and 'z' is way out of line with regualar english usage.
| response 67 of 71: |
Aug 28 23:47 UTC 2003 |
Re #65: I don't see why they would use a null message to check addresses, when they could be making money with a real one and accomplishing the same thing.
| response 68 of 71: |
Aug 29 01:39 UTC 2003 |
Re 67. Maybe a "real" (paying) one isn't always immediately available for a specific list. The letter does bear the hallmarks of a spamhaus, including the randomly generated strings of characters and so on. Maybe there is a guy who believes he is a time traveler and pays money to spammers to blast his message out to the whole world. It is curious that the message has changed significantly since it first appeared a couple of years ago. I seem to recall that the first one I ever saw closed with the hilarious line: "Please do not respond if you are an evil alien."
| response 69 of 71: |
Aug 30 12:10 UTC 2003 |
I've heard that those spams have been traced back to a by-some-accounts mentally disadvantaged young man in ?New England?. Supposedly several people have sold him fake warp drive/time machine/etc. parts for real money, and his family's not happy at all with the situation.
| response 70 of 71: |
Aug 30 14:00 UTC 2003 |
Right: http://www.wired.com/news/culture/0,1284,60141,00.html
| response 71 of 71: |
Aug 30 20:00 UTC 2003 |
This response has been erased.