WARNING - Virus Attempt From A Lad

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Tue Nov 20, 2007 4:53 am

Yes, I've been doing some insult baiting. I prolly knew one of them would attempt this. Here is the email I received, the link is not included.

Quote:


by 0 (qmail-ldap-1.03) with SMTP

for <me>; 20 Nov 2007 02:31:24 -0000
Return-Path: <[email protected]>
Received: from SRV01.tp.local (wcoe-18.r-195-35-231.atwork.nl [195.35.231.18])

by mprdmx13.nwk.myway.com (Postfix) with ESMTP id 66E9853ED3

for <me>; Mon, 19 Nov 2007 21:31:20 -0500 (EST)
Received: from dev01 ([192.168.100.21]) by SRV01.tp.local with Microsoft SMTPSVC(6.0.3790.3959);

Tue, 20 Nov 2007 03:31:31 +0100
Received: by dev01 (sSMTP sendmail emulation); Tue, 20 Nov 2007 03:20:56 +0100
From: [email protected]
[ Add to Address Book | Block Address | Report as Spam ]
Date: Tue, 20 Nov 2007 03:20:56 +0100
To: me
Subject: Hey, you have a new Greeting !!!
Content-Type: text/html
Message-ID: <[email protected]>
X-OriginalArrivalTime: 20 Nov 2007 02:31:31.0359 (UTC) FILETIME=[75FC8AF0:01C82B1D]
X-TM-AS-Product-Ver: SMEX-7.5.0.1243-5.0.1023-15556.002
X-TM-AS-Result: Yes-30.521000-4.000000-31
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No
X-FII-Tracking: 0.006908

Hello friend!
You have just received a postcard Greeting fromsomeone who cares about you...

Just click hereto receive your Animated Greeting !

Thankyou for using www.Greetings.comservices !!!
Please take this opportunity to let yourfriends hear about us by sending them a postcard from our collection!

The link points to a file called postcard.pif at this address: http://mail.embassyethnic.com/

I googled postcard.pif and here's what I found.
Safe link: http://simonspeight.com/2007/01/06/

Just a reminder to practice safe baiting.

Chuck Norris Joined: 11 Jun 2007 Posts: 1369

The "You've got an e-card!" emails are usually spammed out by zombie computers, such as those compromised by the infamous Storm worm.

Posted: Tue Nov 20, 2007 5:00 am

That address has been in existence for exactly 30 hours. I have been using it to launch insult attacks at lads I am simultaneously baiting from other places. I very much doubt it could have come from any other source.

Chuck Norris Joined: 11 Jun 2007 Posts: 1369

Have you done any guest-book seeding or anything like that, by chance?

Go ahead and PM me the malicious link that came with the email.

Posted: Tue Nov 20, 2007 5:03 am

Not with that address, no. PM sent.

Baiting Guru Joined: 31 Jan 2007 Posts: 12237

A Virus on the interwebs? I refuse to believe that.

Posted: Tue Nov 20, 2007 8:54 am

wingman wrote:

That address has been in existence for exactly 30 hours.

... and once you set up a "catchall" email account for any given domain you'll receive greeting cards for thousands of accounts that don't yet exist. Wink

Nope, the lad didn't "send" you a virus, sorry.

Chuck Norris Joined: 11 Jun 2007 Posts: 1369

The bad link hosts a variant of Netsky--this worm has been around for a few years now, but it still goes strong. It is spammed out far and wide via email. Anyway, one trait that this worm has, is that it can scan the infected computer for email addresses. It will then spam itself to all the emails it finds on that machine. So your lad is possibly doing his "work" from an infected machine.

WARNING - Virus Attempt From A Lad	View next topic View previous topic