Fake virus warnings...?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Tue Jul 10, 2007 12:05 pm

I've had some odd spam show up today, including two "virus warnings" that I have the gravest suspicions about.

Each has the same text:

Quote:

Dear Customer,

Our robot has detected an abnormal activity from your IP adress
on sending e-mails. Probably it is connected with the last epidemic
of a worm which does not have official patches at the moment.

We recommend you to install this patch to remove worm files
and stop email sending, otherwise your account will be blocked.

The boldfaced phrase was a link that I didn't follow. I did a properties check and found this:

Quote:

?c955099675c50080d0229e368412571d7d
Protocol: HyperText Transfer Protocol
Type: 11/?C955099675C50080D0229E368412571D7D
Address: http://74.69.xxxxx
URL: c955099675c50080d0229e368412571d7d

I'm assuming it's a sneaky way to get people to upload a virus.

Mod edit - I have xxxxx out part of the url to stop people from accidentally clicking on it - SP

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

Yes.

Posted: Tue Jul 10, 2007 12:31 pm

I got the whole IP before TS xxx'd it. That address is dead at the moment; perhaps his mom made him go to bed and turn off his computer.

I'd say your instinct is spot on. I was going to hit it from a Linux box and see what was there (without the /? at the end).

Did you get the same addy when you hover the cursor over the link in the email? It actually looks like a misformed version of this:

http://74.69.xxx.xxx/?c955099675c50080d0229e368412571d7d

Googling on that long hex number after the ? led me to a Japanese forum filled with spam. The IP addy before your hex number is 76.197.xxx.xxx and it's also dead. The bait on that one was a fake greeting card.

Mod comment: Ratter, that was SP, not I. Wink

TS

Posted: Tue Jul 10, 2007 1:31 pm

Got another one today different IP# in link, got a rule set up so I won't see them again Rolling Eyes

Will go over without thinking about it, just wondering where I dropped that addy to receive this. Guess it's time to drop that addy and get a fresh one.

Posted: Tue Jul 10, 2007 1:39 pm

Yes, we were discussing that worm here, but it probably should be in general rather than help.

Posted: Tue Jul 10, 2007 1:44 pm

Ook, thanks for the pointer.

SP, sorry, I'm used to blaming TS for everything. Very Happy