ya, about spamming c**ksuckers....important: - GoFuckYourself.com

CDSmith · 05-03-2002, 08:07 PM

I'll make this as brief as possible. I have been receiving far more spam than usual lately, and most of it seems to be from the same source, using the same methods. Each spam is from a different email account, each one has a different subject, all of them contain some sort of .exe file or html file coupled with an image file or .pdf etc etc, some of them have no text in the message body, and some have a short amount of text like "Here is a fine website that I hope you would enjoy it" with a link, or something to that effect.

Here's the kicker......
some of the email addresses used by this asshole are OURS.... yours and mine both. I got one supposedly from Mick Bake the other day, and there's now way it was actually from him. I got one from another guy named Rob who runs a bunch of pay sites, and I even got one from one of my own email addy's, so I KNOW that this is what's happening. So I emailed this Rob guy, I looked up the email properties, saw the domain name and went to the site. I found an email address there (admin@____.com or webmaster@_____.com, I didn't want to use the return address of the original spam), and I sent them a nasty email about this Rob guy.

The thing is, Rob himself emailed me back and asked what I was talking about. I then figured it out.... someone is using many of our email addresses somehow for spamming puposes. Rob is actually a pretty good guy, and he's out for blood now. Spammer blood. So, could sexymail be just another victim of this unknown spamming asshole? No really, could it be possible? If your answer is "yes" or "maybe", then maybe we should relax here and talk about what to do about the real fuckwad spammer. It's very hard to program your spam blocking to filter this guy, because he's using other people's addresses and he's keeping his text to a minimum and it changes constantly. I get hit with his shit at least 20-30 times per day right now. I have no idea what the guy is trying to accomplish, I just don't buy shit from spam. Nada. Zip.

Thoughts?
___________
CD
* <a href="http://www.cdsmodels.com/" TARGET="_blank">CD's Models on the Web</a> Centerfolds ~ Amateurs ~ Teens, <a href="http://www.cdsmodels.com/webmasters.html" TARGET="_blank">new trades</a> welcome.
* <a href="http://clickthrutraffic.com/scripts/signup.php?referer=cdsmith" TARGET="_blank"> Click-thrutraffic.com</a> 5 cents up to 20 cents per click!
* <a href="http://www.erasercash.com/wm.html?ID=1380291" TARGET="_blank">ERASERCASH!</a> Earn $45 per sale + webmaster referrals 4 LEVELS DEEP

Midnight · 05-03-2002, 08:12 PM

The latest problems that I have had to resolve for my clients is the following virus. It is a worm with a payload, passed via a vbscript propagation routine. I don't know if this is what is causing your problem, but it is the latest thing that is taking away from my productivity time. There is a link below that will tell you the registry entries to delete, and the files you will need to find. You will have to know about DOS attrib because the original file is loaded in your windows directory and hidden via dos attrib. You will need to do this all from dos, as you will have to boot your machine from a floppy to remove this from the boot entries within your registry.

Hit me up via icq if you need help.

------------------------

W32.Klez.H@mm
Discovered on: April 17, 2002
Last Updated on: May 2, 2002 at 08:54:03 PM PDT

http://www.symantec.com/avcenter/[email protected]

Midnight

Theo · 05-03-2002, 08:26 PM

hahahahahahahaha

we need more of CD-Smith ;)

CDSmith · 05-03-2002, 08:52 PM

Soul, everyone already knows that. Duh!!

Midnight-- something doesn't jive though. The behaviour of the virus you mentioned doesn't jive with what's been happening to me and a lot of others. For one, all of the email addresses used are foriegn to my address book. Only one or two are in my list, the rest are from off the net.

It's a mystery. No, I know there is a power-spammer out there, and with a little help someone should be able to nail his ass to the wall. Have none of you gotten any emails that sounds like what I'm describing?? I find it hard to believe that he's only targetting me as the reciptient. He'll be the poorest spammer on record if that's the case.
___________
CD
* <a href="http://www.cdsmodels.com/" TARGET="_blank">CD's Models on the Web</a> Centerfolds ~ Amateurs ~ Teens, <a href="http://www.cdsmodels.com/webmasters.html" TARGET="_blank">new trades</a> welcome.
* <a href="http://clickthrutraffic.com/scripts/signup.php?referer=cdsmith" TARGET="_blank"> Click-thrutraffic.com</a> 5 cents up to 20 cents per click!
* <a href="http://www.erasercash.com/wm.html?ID=1380291" TARGET="_blank">ERASERCASH!</a> Earn $45 per sale + webmaster referrals 4 LEVELS DEEP

Amputate Your Head · 05-05-2002, 07:54 PM

Quote:

Originally posted by CDSmith
I'll make this as brief as possible. I have been receiving far more spam than usual lately, and most of it seems to be from the same source, using the same methods. Each spam is from a different email account, each one has a different subject, all of them contain some sort of .exe file or html file coupled with an image file or .pdf etc etc, some of them have no text in the message body, and some have a short amount of text like "Here is a fine website that I hope you would enjoy it" with a link, or something to that effect.

Here's the kicker......
some of the email addresses used by this asshole are OURS.... yours and mine both. I got one supposedly from Mick Bake the other day, and there's now way it was actually from him. I got one from another guy named Rob who runs a bunch of pay sites, and I even got one from one of my own email addy's, so I KNOW that this is what's happening. So I emailed this Rob guy, I looked up the email properties, saw the domain name and went to the site. I found an email address there (admin@____.com or webmaster@_____.com, I didn't want to use the return address of the original spam), and I sent them a nasty email about this Rob guy.

The thing is, Rob himself emailed me back and asked what I was talking about. I then figured it out.... someone is using many of our email addresses somehow for spamming puposes. Rob is actually a pretty good guy, and he's out for blood now. Spammer blood. So, could sexymail be just another victim of this unknown spamming asshole? No really, could it be possible? If your answer is "yes" or "maybe", then maybe we should relax here and talk about what to do about the real fuckwad spammer. It's very hard to program your spam blocking to filter this guy, because he's using other people's addresses and he's keeping his text to a minimum and it changes constantly. I get hit with his shit at least 20-30 times per day right now. I have no idea what the guy is trying to accomplish, I just don't buy shit from spam. Nada. Zip.

Thoughts?
___________
CD
* <a href="http://www.cdsmodels.com/" TARGET="_blank">CD's Models on the Web</a> Centerfolds ~ Amateurs ~ Teens, <a href="http://www.cdsmodels.com/webmasters.html" TARGET="_blank">new trades</a> welcome.
* <a href="http://clickthrutraffic.com/scripts/signup.php?referer=cdsmith" TARGET="_blank"> Click-thrutraffic.com</a> 5 cents up to 20 cents per click!
* <a href="http://www.erasercash.com/wm.html?ID=1380291" TARGET="_blank">ERASERCASH!</a> Earn $45 per sale + webmaster referrals 4 LEVELS DEEP

that was brief?

I'd hate to see when you go on a rant......

Amputate Your Head · 05-05-2002, 07:58 PM

I don't think anyone is using your email addy's to spam viruses CD... that's what alot of viruses do nowadays.... once it's in your system, it emails itself to every addy it can find on your computer, using YOUR email addy. It looks like it's coming from you or from someone you know, but it's just the virus.

my brother had this on his system several months ago and ended up formatting c: to get rid of it.

Gemini · 05-05-2002, 08:09 PM

We had one a week or so ago. I went to the site that was being spammed and then reported it to them...

A couple of days later I got an irate email from the site owner yelling at *me*!

Turns out the spammer was spoofing one the paysite owners own email addys. Like I should know that or bother reading the headers (if I could know what this paysite guys header should read like?!)

CDSmith · 05-05-2002, 08:17 PM

The emails are IN-coming spam from others. They all appear to be the same method of spamming, yet they are all from different email addresses. As I said, most of these addresses aren't even IN my computer, they are coming in from addresses of other sites and individuals.

It's as if some spammer is able to send out emails that appear to be from anyone's email address, including yours and mine. As I said, I too have emailed a few of these email addresses to report this, and a few of the webmasters are now after this guy too. It sounds like Gem's gotten email from a similar spammer.

This is not the work of a virus on my computer that sends OUT emails to everyone in my address book. It is coming from outside, from email accounts my computer has never even heard of before. Get it?

Amp, I did really really try to be brief. I did. I know how some people's attention span has trouble beyond the first 2 sentences. Sorry 'bout that.

___________
CD
* <a href="http://www.cdsmodels.com/" TARGET="_blank">CD's Models on the Web</a> Centerfolds ~ Amateurs ~ Teens, <a href="http://www.cdsmodels.com/webmasters.html" TARGET="_blank">new trades</a> welcome.
* <a href="http://clickthrutraffic.com/scripts/signup.php?referer=cdsmith" TARGET="_blank"> Click-thrutraffic.com</a> 5 cents up to 20 cents per click!
* <a href="http://www.erasercash.com/wm.html?ID=1380291" TARGET="_blank">ERASERCASH!</a> Earn $45 per sale + webmaster referrals 4 LEVELS DEEP

Amputate Your Head · 05-05-2002, 08:19 PM

okay.

Gemini · 05-05-2002, 08:28 PM

From what our tech told us, he could teach me to spoof other peoples email addys in less than 5 mins. So expect it more and more.

One the other bites is when they spoofed or plain spam and have their date set back on their server so its mixed in with old mail if you have any saved back in the inbox. Grrrr

CDSmith · 05-05-2002, 08:35 PM

Yes, very much grrrrrr.

The thing I just don't get about this type of spammer is.... what do they hope to gain?

This particular guy is pretty easy to spot too. All his mails have similar text, and similarly-named files, and although the subjects are all different, they are also somehow very similar as well.

The thing is, it's very hard to "set a rule" soas to block him, because there seems to be no common keyword in all these mails. I'm not sure how to block him.

Double grrrr.
___________
CD
* <a href="http://www.cdsmodels.com/" TARGET="_blank">CD's Models on the Web</a> Centerfolds ~ Amateurs ~ Teens, <a href="http://www.cdsmodels.com/webmasters.html" TARGET="_blank">new trades</a> welcome.
* <a href="http://clickthrutraffic.com/scripts/signup.php?referer=cdsmith" TARGET="_blank"> Click-thrutraffic.com</a> 5 cents up to 20 cents per click!
* <a href="http://www.erasercash.com/wm.html?ID=1380291" TARGET="_blank">ERASERCASH!</a> Earn $45 per sale + webmaster referrals 4 LEVELS DEEP

Brian · 05-05-2002, 08:44 PM

I get tons of them all the time.

I got a virus from what appeared to be [email protected] the other day. I can only assume it wasn't him who sent it.

quadtime · 05-05-2002, 10:41 PM

Got spammed for ink jet recharges with my actual email address as reply address... smart... then got flooded with a couple hundreds of spam replies like "fuck you", "remove me asshole", "I want ink jet recharges" <- what a moron.

Enjoy.

05-03-2002, 08:07 PM	#1
CDSmith Too lazy to set a custom title Industry Role: Join Date: May 2001 Location: My network is hosted at TECHIEMEDIA.net ...Wait, you meant where am I located at? Oh... okay, I'm in Winnipeg, Canada. Oops. :) Posts: 51,460	ya, about spamming cksuckers....important:** I'll make this as brief as possible. I have been receiving far more spam than usual lately, and most of it seems to be from the same source, using the same methods. Each spam is from a different email account, each one has a different subject, all of them contain some sort of .exe file or html file coupled with an image file or .pdf etc etc, some of them have no text in the message body, and some have a short amount of text like "<i>Here is a fine website that I hope you would enjoy it</i>" with a link, or something to that effect. Here's the kicker...... some of the email addresses used by this asshole are OURS.... yours and mine both. I got one supposedly from Mick Bake the other day, and there's now way it was actually from him. I got one from another guy named Rob who runs a bunch of pay sites, and I even got one from one of <i>my own email addy's</i>, so I KNOW that this is what's happening. So I emailed this Rob guy, I looked up the email properties, saw the domain name and went to the site. I found an email address there (admin@____.com or webmaster@_____.com, I didn't want to use the return address of the original spam), and I sent them a nasty email about this Rob guy. The thing is, Rob <i>himself</i> emailed me back and asked what I was talking about. I then figured it out.... someone is using many of our email addresses somehow for spamming puposes. Rob is actually a pretty good guy, and he's out for blood now. Spammer blood. So, could sexymail be just another victim of this unknown spamming asshole? No really, could it be possible? If your answer is "yes" or "maybe", then maybe we should relax here and talk about what to do about the real fuckwad spammer. It's very hard to program your spam blocking to filter this guy, because he's using other people's addresses and he's keeping his text to a minimum and it changes constantly. I get hit with his shit at least 20-30 times per day right now. I have no idea what the guy is trying to accomplish, I just don't buy shit from spam. Nada. Zip. Thoughts? <font face="Verdana"><b>___________</b> CD * <a href="http://www.cdsmodels.com/" TARGET="_blank"><font color="#FF0000">CD's Models on the Web</font></a> Centerfolds ~ Amateurs ~ Teens, <a href="http://www.cdsmodels.com/webmasters.html" TARGET="_blank">new trades</a> welcome. * <a href="http://clickthrutraffic.com/scripts/signup.php?referer=cdsmith" TARGET="_blank"><font color="#FFDDFF"> Click-thrutraffic.com</font></a> 5 cents up to 20 cents per click! * <a href="http://www.erasercash.com/wm.html?ID=1380291" TARGET="_blank"><font face="Verdana" color="#FFCCCC">ERASERCASH!</font></a> Earn $45 per sale + webmaster referrals <i>4 LEVELS DEEP</i></font>

05-03-2002, 08:52 PM	#4
CDSmith Too lazy to set a custom title Industry Role: Join Date: May 2001 Location: My network is hosted at TECHIEMEDIA.net ...Wait, you meant where am I located at? Oh... okay, I'm in Winnipeg, Canada. Oops. :) Posts: 51,460	Soul, everyone already knows that. Duh!! Midnight-- something doesn't jive though. The behaviour of the virus you mentioned doesn't jive with what's been happening to me and a lot of others. For one, all of the email addresses used are foriegn to my address book. Only one or two are in my list, the rest are from off the net. It's a mystery. No, I know there is a power-spammer out there, and with a little help someone should be able to nail his ass to the wall. Have none of you gotten any emails that sounds like what I'm describing?? I find it hard to believe that he's only targetting me as the reciptient. He'll be the poorest spammer on record if that's the case. <font face="Verdana"><b>___________</b> CD * <a href="http://www.cdsmodels.com/" TARGET="_blank"><font color="#FF0000">CD's Models on the Web</font></a> Centerfolds ~ Amateurs ~ Teens, <a href="http://www.cdsmodels.com/webmasters.html" TARGET="_blank">new trades</a> welcome. * <a href="http://clickthrutraffic.com/scripts/signup.php?referer=cdsmith" TARGET="_blank"><font color="#FFDDFF"> Click-thrutraffic.com</font></a> 5 cents up to 20 cents per click! * <a href="http://www.erasercash.com/wm.html?ID=1380291" TARGET="_blank"><font face="Verdana" color="#FFCCCC">ERASERCASH!</font></a> Earn $45 per sale + webmaster referrals <i>4 LEVELS DEEP</i></font>

05-05-2002, 08:17 PM	#8
CDSmith Too lazy to set a custom title Industry Role: Join Date: May 2001 Location: My network is hosted at TECHIEMEDIA.net ...Wait, you meant where am I located at? Oh... okay, I'm in Winnipeg, Canada. Oops. :) Posts: 51,460	The emails are IN-coming spam from others. They all appear to be the same method of spamming, yet they are all from different email addresses. As I said, most of these addresses aren't even IN my computer, they are coming in from addresses of other sites and individuals. It's as if some spammer is able to send out emails that appear to be from anyone's email address, including yours and mine. As I said, I too have emailed a few of these email addresses to report this, and a few of the webmasters are now after this guy too. It sounds like Gem's gotten email from a similar spammer. This is not the work of a virus on my computer that sends OUT emails to everyone in my address book. It is coming from outside, from email accounts my computer has never even heard of before. Get it? Amp, I did really really try to be brief. I did. I know how some people's attention span has trouble beyond the first 2 sentences. Sorry 'bout that. <font face="Verdana"><b>___________</b> CD * <a href="http://www.cdsmodels.com/" TARGET="_blank"><font color="#FF0000">CD's Models on the Web</font></a> Centerfolds ~ Amateurs ~ Teens, <a href="http://www.cdsmodels.com/webmasters.html" TARGET="_blank">new trades</a> welcome. * <a href="http://clickthrutraffic.com/scripts/signup.php?referer=cdsmith" TARGET="_blank"><font color="#FFDDFF"> Click-thrutraffic.com</font></a> 5 cents up to 20 cents per click! * <a href="http://www.erasercash.com/wm.html?ID=1380291" TARGET="_blank"><font face="Verdana" color="#FFCCCC">ERASERCASH!</font></a> Earn $45 per sale + webmaster referrals <i>4 LEVELS DEEP</i></font>

05-05-2002, 08:35 PM	#11
CDSmith Too lazy to set a custom title Industry Role: Join Date: May 2001 Location: My network is hosted at TECHIEMEDIA.net ...Wait, you meant where am I located at? Oh... okay, I'm in Winnipeg, Canada. Oops. :) Posts: 51,460	Yes, very much grrrrrr. The thing I just don't get about this type of spammer is.... what do they hope to gain? This particular guy is pretty easy to spot too. All his mails have similar text, and similarly-named files, and although the subjects are all different, they are also somehow very similar as well. The thing is, it's very hard to "set a rule" soas to block him, because there seems to be no common keyword in all these mails. I'm not sure how to block him. Double grrrr. <font face="Verdana"><b>___________</b> CD * <a href="http://www.cdsmodels.com/" TARGET="_blank"><font color="#FF0000">CD's Models on the Web</font></a> Centerfolds ~ Amateurs ~ Teens, <a href="http://www.cdsmodels.com/webmasters.html" TARGET="_blank">new trades</a> welcome. * <a href="http://clickthrutraffic.com/scripts/signup.php?referer=cdsmith" TARGET="_blank"><font color="#FFDDFF"> Click-thrutraffic.com</font></a> 5 cents up to 20 cents per click! * <a href="http://www.erasercash.com/wm.html?ID=1380291" TARGET="_blank"><font face="Verdana" color="#FFCCCC">ERASERCASH!</font></a> Earn $45 per sale + webmaster referrals <i>4 LEVELS DEEP</i></font>

05-05-2002, 08:44 PM	#12
Brian Confirmed User Join Date: Jan 2001 Location: Amherst, MA Posts: 450	I get tons of them all the time. I got a virus from what appeared to be [email protected] the other day. I can only assume it wasn't him who sent it. __________________ ICQ: 89118055 HerbalCommerce.com - Herbal Product Manufacturing/Private labeling - NOT a middleman! WebmasterCommerce.com - Webmaster Resources FightResource.com - *THE* Online Mixed Martial Arts Directory

05-03-2002, 08:12 PM	#2
Midnight Confirmed User Join Date: Jun 2001 Location: ONLINE Posts: 330	The latest problems that I have had to resolve for my clients is the following virus. It is a worm with a payload, passed via a vbscript propagation routine. I don't know if this is what is causing your problem, but it is the latest thing that is taking away from my productivity time. There is a link below that will tell you the registry entries to delete, and the files you will need to find. You will have to know about DOS attrib because the original file is loaded in your windows directory and hidden via dos attrib. You will need to do this all from dos, as you will have to boot your machine from a floppy to remove this from the boot entries within your registry. Hit me up via icq if you need help. ------------------------ W32.Klez.H@mm Discovered on: April 17, 2002 Last Updated on: May 2, 2002 at 08:54:03 PM PDT http://www.symantec.com/avcenter/[email protected] Midnight

05-03-2002, 08:26 PM	#3
Theo HAL 9000 Industry Role: Join Date: May 2001 Posts: 34,515	hahahahahahahaha we need more of CD-Smith ;)

05-05-2002, 07:58 PM	#6
Amputate Your Head There can be only one Industry Role: Join Date: Aug 2001 Location: Somewhere else Posts: 39,075	I don't think anyone is using your email addy's to spam viruses CD... that's what alot of viruses do nowadays.... once it's in your system, it emails itself to every addy it can find on your computer, using YOUR email addy. It looks like it's coming from you or from someone you know, but it's just the virus. my brother had this on his system several months ago and ended up formatting c: to get rid of it.

05-05-2002, 08:09 PM	#7
Gemini Confirmed User Join Date: Jan 2001 Location: o-HI-o Posts: 7,183	We had one a week or so ago. I went to the site that was being spammed and then reported it to them... A couple of days later I got an irate email from the site owner yelling at me! Turns out the spammer was spoofing one the paysite owners own email addys. Like I should know that or bother reading the headers (if I could know what this paysite guys header should read like?!)

05-05-2002, 08:19 PM	#9
Amputate Your Head There can be only one Industry Role: Join Date: Aug 2001 Location: Somewhere else Posts: 39,075	okay.

05-05-2002, 08:28 PM	#10
Gemini Confirmed User Join Date: Jan 2001 Location: o-HI-o Posts: 7,183	From what our tech told us, he could teach me to spoof other peoples email addys in less than 5 mins. So expect it more and more. One the other bites is when they spoofed or plain spam and have their date set back on their server so its mixed in with old mail if you have any saved back in the inbox. Grrrr

05-05-2002, 10:41 PM	#13
quadtime Registered User Join Date: Apr 2002 Location: Montreal, QC Posts: 23	Got spammed for ink jet recharges with my actual email address as reply address... smart... then got flooded with a couple hundreds of spam replies like "fuck you", "remove me asshole", "I want ink jet recharges" <- what a moron. Enjoy. __________________ <a href='http://top.hentaivids.com'>Hentai Vids Toplist</a>