Moogie Sends Dyyryath a Virus

[Dyyryath]

OK, not really. In reality, I got a nasty, virus laden email from a mail server at 80.55.240.58, which had spoofed the from address to look like it came from Moogie. Now, I know Moogie, and she's a pretty sweet woman who probably wouldn't send me something nasty like that unless I'd pissed her off (and I really try not to do that <img src=http://www.free-dc.org/images/news/icon36.gif>) so I wasn't too concerned about it. I just deleted it (I'm on Linux so the virus wouldn't have been a threat anyway) and went on about my merry way.<br><br>Then later this evening, I got a note from IronBits. Evidently, he'd been politely warned by magnav0x that I was sending nasty things around and to watch out for me. Now, I'm occasionally a bit too curmudgeony for my own good, but I was pretty sure I wasn't out to get anybody. <img src=http://www.free-dc.org/images/news/icon51.gif><br><br>magnav0x & I compared notes and it looks like these messages are all coming from that same server. Most likely, someone who has a bunch of Free-DC email addresses in their addressbook has been infected. Unfortunately, that probably means it's one of our members. If you're running something other than Windows, you can probably count yourselves out. If you are running Windows, you might want to make sure your virus scanner is up to date and double check your system. If you're not sure how to do this, give us a post in the forums and somebody will certainly be willing to give you a hand.<br><br>In the meantime, here's the deal. If you get an email from someone on the team that contains an 'archive' attachment and a password to open it, you can bet that it's probably not racy pictures of the ever sexy Miss Moogie, but rather something that you just want to delete without opening. <img src=http://www.free-dc.org/images/news/icon41.gif>

[magnav0x]

Well obviously I knew you didn't send it purposly Dyyryath....I don't think you would ever send out an e-mail with

Subject: ^_^ mew-mew (-:
Message: I don't bite, weah!


A not to anyone that recieves something similar to this. The message is random as well as the subject and attached file. I presume it cicles through the e-mail addies in the person's address book when it sends them out. If your computer is infected and you have people in your address book....please do them a favor and e-mail them to warn them. You're computer will begin to send them out as well once you are infected. For those curious about it....I unplugged my computer from the network and proceeded to open the files in the e-mails to discover exactly what they were doing. Don't worry I cleaned everything up before I put it back on the internet (or you should all hope :D ) Needless to say there are no names in my address book on this windows box, cause I'm a big looser and all, so you are all safe :thumbs:

Just be careful of what you open, especially if it doesn't look right. (geeze I sound like my mother)

[IronBits]

Thanks for the heads up! :)
:mouserun:
/me runs off to add 80.55.240.58 to his mailservers deny list

[magnav0x]

p.s. It seems to have originated from someone in Europe.....

[Fozzie]

to stomp out those Colonials with germ warfare before the Eon Guantlet.:D

[magnav0x]

It's an Empire plot to stomp out those Colonials with germ warfare before the Eon Guantlet.

Hey he's right! Bloody imperials!

[wirthi]

Check out http://www.ripe.net/perl/whois?form_type=simple&full_query_string=&searchtext=80.55.240.58

Nslookup reports that the computer is yg8.internetdsl.tpnet.pl. Sounds like a DSL connection to me.

Seems to be from Poland. Anybody from Poland here?

I get tons of emails from faked Adresses every day. Many of those look like coming from somebody I know. None of them actually do. I wouldn't take that too serious, would be quite hard to really track down the computer that actually sent the mails. If it would be easier, those bloddy viruses would not be so successful.

[Moogie]

LOL!!!!

If it makes you feel any better, I got the same email that mags was referencing about 4 times...once from mags himself and then from a couple of other places.

I'm telling you...I didn't do it! I was in Buffalo!

I just want to take the time to thank my buddy Dyy for using my name and "virus" in the same sentence. :D

:rotfl:

It's always good to be reminded..."NEVER" open and attachmet unless it's from a trusted source.

Take care all!

[wirthi]

Originally posted by Moogie
It's always good to be reminded..."NEVER" open and attachmet unless it's from a trusted source.

Take care all! Well, that's the problem. For Dyyryath, you ARE a trusted source ....

That makes those new viruses so dangerous. They seem to come from someone you know.

[rshepard]

It's gotten to the point where there are no trusted sources as far as I'm concerned-- if I get an unexpected file from someone at work for example, I always confirm with them that they sent me something rather than just opening it, even if it looks legitimate. :(

[Moogie]

That's not a bad idea at all. It's sad that it has come to that. Alot of times, the subject will give it away, but not always.

[Anteraan]

My friends and I have a little protocol we follow in that, prior to sending someone an attachment, we send them an e-mail indicating that we are going to send an attachment. These "warning" e-mails usually include some sort of personal reference, inside joke, etc. The best plan is still vigilance, but this method seems to work quite well as a backup.

[pointwood]

I have an old account which gets loads of those emails with fake sender address. Yesterday I even got one from myself :rolleyes:

Now, I'm using Mozilla Thunderbird and the spam filter catches most of this (just installed 0.6 and reset the training data, so it's getting better every day currently). If I couldn't use the Thunderbird spam filter, I would have given up on that account long ago.

I don't know what I would do if I ever met a spammer or virus writer in person...

[dragongoddess]

correct me if I'm mistaken because I often am.
I put my email address in my address book on the assumption that if I receive an e- mail from myself then my computer has been compromised. Is this a valid assumption.

[pointwood]

No, you just have to be in the addressbook of someone else.

In my case, the old email account I got actually have 2 email addresses because the ISP changed name which means I can use both @worldonline.dk and @tiscali.dk. I've now recieved a few mails which displays itself as comming from @worldonline.dk.

[Paratima]

Originally posted by dragongoddess
correct me if I'm mistaken because I often am.
I put my email address in my address book on the assumption that if I receive an e- mail from myself then my computer has been compromised. Is this a valid assumption. That would depend on how much you talk to yourself. :p

[Richard Clyne]

First, there is nothing wrong with talking to yourself. :gone:

Secondly, the best way to stop receiving suspect emails from friends is don't have any friends. :) It works for me. I have had my email address for two years and I have yet to receive a virus or a single bit of spam.

Last, but not least, you could always add Moogie to your email ignore list. It works for me :D :moon:

[dragongoddess]

Well I have been know to listen to the voices in my head and I sometimes have to break up a discussion between them when they get rowdy. The voices got so bad they got me kicked out of MENSA. Seems the president of the local chapter lost a debate with one of my alter egos so asked for a vote. Several of my voices voted against me. Now thats bad.

[Moogie]

Originally posted by dragongoddess
correct me if I'm mistaken because I often am.
I put my email address in my address book on the assumption that if I receive an e- mail from myself then my computer has been compromised. Is this a valid assumption.

Not necessarily compromised.

A typical spammer's trick is to by hook, crook, or bribery, get control of an email server. Then, they send messages to all possible combinations of letters that can make an email address, starting with something like ABC@Yahoo.com and ending with ZZZ@Yahoo.com. Those messages that do not bounce are therefore valid. They usse one, or all, of the valid email addresses to send spam to every other email address (including your email address) from every other email address he has (again, including yours). All this is done on a computer that the spammer has control of. If your PC is behind a fire-wall, and has up-to-date virus protection, you should be OK. One way to check is to go to www.grc.com and select Shields Up!, which will do a preliminary test of the security of your machine. In any case, if you receive an email addressed to you, FROM you, that you did not expect, just delete it.

[Moogie]

Originally posted by dragongoddess
Well I have been know to listen to the voices in my head and I sometimes have to break up a discussion between them when they get rowdy. The voices got so bad they got me kicked out of MENSA. Seems the president of the local chapter lost a debate with one of my alter egos so asked for a vote. Several of my voices voted against me. Now thats bad.

:rotfl: :rotfl: :rotfl: