🚀 go-pugleaf

Active8 wrote:
> 
> In article <3f4939c.0309190951.5ee61d08@posting.google.com>,
> amcintosh@stmarytx.edu says...
> > I have received almost 700 copies of worm or virus mail to this
> > account in the past 24 hours.
> >
> > This has been the GIBE virus, the new "returned mail" item.
> >
> > Anyone else?
> >
> 
> i see linux systems weren't affected nor DOS or, suprisingly, MS IIS. i
> swear these attacks only happen *after* ms posts a security bulletin.
> then the script kiddies go to work figuring that people don't check for
> updates and apply them.
> 
> for the past week, i've only had two e-mail spams sitting on the ISPs
> server. i didn't download them, i just saw them in mailwasher -
> www.mailwasher.net
> 
> i just got in and there were an additional 55 on the server. one of them
> came from someone i know who most likely has me in her address book
> which will be outhouse excuse as Jim calls it - i like that.
> 
> i'll use mailwasher to bounce them as invalid address. i see one money
> making spam *may* have been harvested from usenet assuming it stripped
> the "invalid" off the end of my posting addy. that would have happened
> (and it's dated a week or so ago) before i further obfuscated my addy.
> it has an opt out.
> 
> the flood:
> 
> i see one has gekjau.exe attached. it's from
> 
> "Internet Message System" <masterroutine@rocketmail.com>
> 
> an undeliverable message. i didn't send jack so nothing can be returned.
> 
> another "undeliverable" with
> 
> Content-Type: audio/x-wav; name="gsfoego.exe" i can see the MIME type
> causing that to get run, but not here. i'm covered.
> 
> both are 800 lines - see the pattern?
> 
> another one with
> 
> Content-Type: audio/x-wav; name="ccihsep.scr"
> 
> an executable screensaver
> 
> there's more "returned" mails but i also have a slew of those ms
> security updates and other ms crap. i usually don't get so many of
> those. maybe 1 a month (cause i bounce, not delete.) no exe files
> attached but the ones i checked are all 800 lines. hmmm... what's with
> 800 lines?
> 
> i see a lot of "MS" crap which is *not* the update ruse, but returned
> mail with exe files.
> 
> i think i'll leave the stuff on the ISPs server and let them examine it,
> unless they tell me to go ahead and bounce it. nice feature - they have
> online chat support.
> 
> well earthlink doesn't care. so much for trying to help them. they said
> to contact MS. f MS. i'm not infected. sarc will find the bastard,
> maybe.
> 
> looks like i got off easy on this flood, so far. sorry to hear others
> got hammered.
> 
> mike

   Those *****.exe are garbage names to hide the worm.automat.abh, or
another variation of the worm.

   I have received over 2200 in the past 24 hours.  (1857 in the last 12
hours) I use Mailwasher to delete them, but they were coming in so fast
I couldn't dump the mailbox before the Earthlink mail server would time
out.
-- 


Michael A. Terrell
Central Florida