Gotta love random e-mails

quote:

---

the Group

---

Illuminati!

That''s like 3 junk e-mails in one. Damn, spammers are getting impatient.

Going to the site gets me:
SQL error: Error DB: [(2003, "Can''t connect to MySQL server on ''db-priv'' (60)")] err: i am trap now! (vph.crash_err set 1) or somebody want trap do= trap

quote:

---

Original post by kordova
Going to the site gets me:
SQL error: Error DB: [(2003, "Can''t connect to MySQL server on ''db-priv'' (60)")] err: i am trap now! (vph.crash_err set 1) or somebody want trap do= trap

---

It gives me someone''s photo album.

hmm strange, is there more? is there a pure text version of it embeded in the same mail or additional stuff?

the last spam i got was some strange msg telling me it failed to deliver to C@microsoft.com from some mail like mailmaster@something..., there was an attachment (virus scanner doesnt found anything suspicious), but looking at the hex i can find my mail inthere (only this site has my mail addy, so someone collects mails at gdnet ?!?) and it has strange parts in it like:

"Found to be clean
Subject: Hello, bestellung, here´s a nice Picture
To: < bestellung@hauppauge.de >"


ahh whats going on? is this a new sort of spam trying to interest users do what the message is about?

edit: oh whats this: "X-Mail Scanner" ?!? someone has a hint? and is this some sort of linux virus (has root as word inthere..)?


T2k

[edited by - T2k on January 7, 2004 6:04:12 PM]

That sounds kind of weird T2K. I''m sure that no one from the staff gave away your info, probably just a spider that looks at everything on the site till it finds an address, assuming that the e-mail in your profile is the one that you''re talking about.

quote:

---

Original post by caffeineaddict
That sounds kind of weird T2K. I''m sure that no one from the staff gave away your info, probably just a spider that looks at everything on the site till it finds an address, assuming that the e-mail in your profile is the one that you''re talking about.

---

yeah thats the mail, but i dont think a spider will generate a mail with some sort of executable attachment or whatever and contain german word in it (iam from german)... damn someone want to trash a system and test it out? :D


T2k

quote:

---

Original post by T2k
edit: oh whats this: "X-Mail Scanner" ?!? someone has a hint? and is this some sort of linux virus (has root as word inthere..)?

---

``X-Mail Scanner'''' is a header specifying information about the virus scaning engine that was used to scan this email. This runs on the server with the MTA (Mail Transfer Agent.)

Linux does not have viruses.

"has root as word inthere" - I dont understand you

quote:

---

Original post by aftermath
Linux does not have viruses.

---

The humor in that statement was found dead at it''s house yesterday morning, appearently suffering from a degenerative mental disorder. In fact, one person comments "he never really seemed to be there."

quote:

---

Original post by aftermath
Linux does not have viruses.

---

...

quote:

---

"has root as word inthere" - I dont understand you

---

yeah the first 512bytes dont make sens and then are followed by "Root Entry"... (unicode), thought about the root account on linux but that makes no sense now,
:D unzipped part of the message and ahh looks like a trojan : "Sefex" hmm not very interesting... has a file called torvil.exe and this file is somehow encoded in html (how do i unencode it to get a executable? wanna try something)


T2k

quote:

---

Original post by cowsarenotevil

quote:

---

Original post by aftermath
Linux does not have viruses.

---

The humor in that statement was found dead at it's house yesterday morning, appearently suffering from a degenerative mental disorder. In fact, one person comments "he never really seemed to be there."

---

To true, you aftermath are an idiot (unless that was some humorless joke...)

Edit: T2K this is from Symantec

quote:

---

When Trojan.Sefex is executed, it will extract and run an executable file in the HTML file.

---

---

It's Maxd Gaming, put in an underscore and I will beat you with a rubber ducky!
{ Check out my Forum } { My First Space Art (Ever) }{ My Second Space Art (Ever) }{ My upcoming space mod for Battlefield: 1942. }

[edited by - Maxd Gaming on January 7, 2004 6:58:11 PM]

IIRC sending random bullshit in email is a clear sign of Bayesian poisoning, attempting to make Bayesian spam-filtering systems learn commonly used words, lose their minds and filter things incorrectly.

Resist everyone
I am your only friend. Click here for more information.

The best way to life spam free, IMHO, is to use reverse DNS lookups in the FROM field of the email. If it is valid, then send an email back asking for a receipt, once you get the receipt then just add the sender to the white list.

Blacklist everything else. Also, reject ALL html email.

aftermath is teh true!

I might add also, that you shouldn''t trust e-mail that comes with a recipt request built in. That''s just another way of verifying an e-mail address. Of course, if it''s from someone you know, that''s a different matter.

But the first rule of thumb for getting rid of spam: Trust no one (you don''t already know in person).

quote:

---

Original post by cowsarenotevil

quote:

---

Original post by kordova
Going to the site gets me:
SQL error: Error DB: [(2003, "Can''t connect to MySQL server on ''db-priv'' (60)")] err: i am trap now! (vph.crash_err set 1) or somebody want trap do= trap

---

It gives me someone''s photo album.

---

Click next a few times.

erhm, hmm strange now my word wants to connect the internet, target is 64.94.110.11 (VeriSign) but why (has it todo with my actions, ive no infection and dont remember additional changes i made at the same time)?

@maxd gaming: i know what it is and how it works (at least how the older version if this worm worked), have it read on the internet, but this one seems to be a new variant...


T2k

Have any of you read KalvinB's writings on the subject? He's found the best way to filter spam, though he may have expressed it in his usual angry manner

[edited by - Superpig on January 8, 2004 9:30:04 AM]