View previous topic :: View next topic |
Author |
Message |
guyver47 Site Owner
Joined: 18 Oct 2003 Posts: 69 Location: Pittsburgh, PA
|
Posted: Fri Mar 05, 2004 1:58 am Post subject: Planetfurry mail |
|
|
I received this e-mail today and am unsure if this is a hoax:
Has anyone been receiving e-mail from [email protected]? I haven't sent out any.
Dear user of Planetfurry.com,
Some of our clients complained about the spam (negative e-mail content)
outgoing from your e-mail account. Probably, you have been infected by
a proxy-relay trojan server. In order to keep your computer safe,
follow the instructions.
For more information see the attached file.
For security reasons attached file is password protected. The password is "#####".
Kind regards,
The Planetfurry.com team http://www.planetfurry.com |
|
Back to top |
|
|
SkunkFox Registered User
Joined: 14 Aug 2002 Posts: 1017 Location: Close to Houston
|
Posted: Fri Mar 05, 2004 2:41 am Post subject: |
|
|
Nope, been getting nothing from you at all, nor have I ever seen Whip send out an e-mail like that before. It looks like a form, uh run your anti-virus software right now hun. That does not look like something whip would send like at all, and that password protection on an attachment Does Not look normal!! _________________ Insane and loving it!
http://www.furaffinity.net/user/darkfox2/ |
|
Back to top |
|
|
guyver47 Site Owner
Joined: 18 Oct 2003 Posts: 69 Location: Pittsburgh, PA
|
Posted: Fri Mar 05, 2004 4:00 am Post subject: |
|
|
There was an attached zip file, but I did not open it.
What is this? Virus month?
I am waiting on virus scanner software at the moment XD |
|
Back to top |
|
|
anthony Site Owner
Joined: 12 Nov 2001 Posts: 1304 Location: Norway
|
Posted: Fri Mar 05, 2004 7:19 am Post subject: |
|
|
Greetings!
I received a VERY similar message from my ISP yesterday, and I immediately discarded it as another worm because of three points:
1. The language was English. (My ISP only send out Norwegian language messages)
2. It claimed MY computer had been infected witha trojan/worm that was sending mails. (My computer is a Psion netBook, running Symbian OS5 and there are no nasties for that OS)
3. It contained a Windoooze executeable(in this case a .PIF file which among other things tries to shut down a few important processes.)
Nasty stuff that.
If your ISP (or someone claiming to be) sends you something, ONLY EVER accept a list of steps and verifiable weblinks, NEVER any executeables.
Password protected files are especially NO NO as they can't be analyzed by real-time anti-virus scanners. _________________ "My name's Lion, Anthony Lion"
A fur with a license to purr...
---
Like my Avatar?
Why not surf over to www.micecomics.com and tell Mary what a stellar job she did... |
|
Back to top |
|
|
mwalimu Registered User
Joined: 08 Nov 2002 Posts: 782 Location: Normal, IL
|
Posted: Fri Mar 05, 2004 9:59 am Post subject: |
|
|
I got those at two different accounts (from unrelated providers) earlier this week. And the English was poor, suggesting the writer was probably not a native English speaker. _________________ mwalimu
My webpage -*-*- My LiveJournal
Badgers and mushrooms and snakes, oh my! |
|
Back to top |
|
|
elMaxx Administrator
Joined: 01 Dec 2000 Posts: 1127 Location: Land of Mud
|
Posted: Fri Mar 05, 2004 10:31 am Post subject: |
|
|
Sorry for the late reply, doesn't seem like the language Whip or I would use in a notification, and we would never send out anything like that...
Guyver, please forward the email message to Whip and/or I to add it to the Spam/virus filter.
Whiplash: [email protected]
Me: [email protected]
Thanks a bunch, and take care. _________________ [Citation Needed] |
|
Back to top |
|
|
elMaxx Administrator
Joined: 01 Dec 2000 Posts: 1127 Location: Land of Mud
|
Posted: Fri Mar 05, 2004 12:34 pm Post subject: |
|
|
Mike Regan wrote: |
When it comes to mail, be paranoid. |
Yup! listen to the ma... fur _________________ [Citation Needed] |
|
Back to top |
|
|
Elfen_Furry Moderator
Joined: 18 Jun 2002 Posts: 2601 Location: NYC NY
|
Posted: Fri Mar 05, 2004 2:46 pm Post subject: |
|
|
Congratulations!!!
You or one of your email buddies have been "Beageled"...
Its an email worm that strikes MS systems and really screws them up and spreads to others in your address book.
With the latest onslaught of email viruses that has been coming around for the past month, you was hit with one of the many of its variants. From my standpoint, there is a viral war going on between the houses of virus coders, and each is blaming the other for the releases...
We just have to wait it out and see what happens. Unit then:
delete it, disinfect the system, hope for the best. _________________ SHARKS In The Gene Pool South of Kosovo!
*CHOMP!* |
|
Back to top |
|
|
Nite Administrator
Joined: 29 Jun 2003 Posts: 1085 Location: Purgatory
|
Posted: Fri Mar 05, 2004 3:58 pm Post subject: |
|
|
I'm getting that same problem on my anti-aol.com mailbox... but it's an odd way. It's telling me I'm trying to send it out, but I know for a fact I don't have Bagle. Probably just a program spoofing my e-mail address, but it's still very annoying.
And Elfen, the virus name is Bagle, not Beagle! (furry on the brain, hehe ). |
|
Back to top |
|
|
Whip-lash Kneel before me... for I am Root!
Joined: 20 Nov 2000 Posts: 573
|
Posted: Sat Mar 06, 2004 4:13 pm Post subject: Re: Planetfurry mail |
|
|
guyver47 wrote: | I received this e-mail today and am unsure if this is a hoax:
Has anyone been receiving e-mail from [email protected]? I haven't sent out any.
<snip>
|
If anyone still has a copy of this or similar messages allegedly sent from Planetfurry, the Planetfurry Admin Staff, etc., please forward them with the headers intact (preferably send the emails as forwarded attachments) to [email protected].
I've not received any messages like this, but I have either received or noticed others receiving (because most are trapped by the spam or virus filters) ones similar to those that Mike noted. It sounds like this is similar to those in the way they parse out the recipient's email address and use parts of the data inside the subject and body to make it appear to be legitamate.
Let me reiterate what has already been stated by others in that nobody belonging to the Planetfurry Admin Staff will send official notifications like this containing zip (or other compressed formats) or executable files. |
|
Back to top |
|
|
Whip-lash Kneel before me... for I am Root!
Joined: 20 Nov 2000 Posts: 573
|
Posted: Sat Mar 06, 2004 4:43 pm Post subject: |
|
|
guyver47 wrote: | There was an attached zip file, but I did not open it.
What is this? Virus month?
I am waiting on virus scanner software at the moment XD |
It sure seems like it.
A quick note about emails passing through Planetfurry.com's email server. Any message received or sent by the server is scanned for spam and viruses.
You may request to have your address not have incoming messages scanned for spam, but virus scanning is unconditional.
Prior to September 22, 2003, Planetfurry used Sophos as our primary virus scanner. This proved to be too costly so we switched to Network Associates McAfee. Along with the cost benefits, virus definition updates are easier to apply, and are updated more often.
This of course does not mean every email you receive is perfectly safe. As demonstrated these past few days, many new viruses came out in a short amount of time, leaving those who maintain these virus definitions to play catchup. Please make sure common sense is used when receiving messages with attachments, whether sent by those you know or not.
Messages found to have a virus or virus-like attachment or content will have {Virus?} tagged onto the beginning of the subject. Executables (*.exe, *.pif, etc.) are marked as viruses to help prevent extremely new viruses not yet in the virus definition lists from spreading. (However, many new viruses are now sending these files inside zip compressed files, preventing this early prevention system from working effectively) Spam (messages with spam-like criteria) and High Score Spam (those with definate spam traits or are linked to known spammers on several blacklists) are respectfully tagged with {Spam?} or {HighScoreSpam?}.
If you have any questions on what is not allowed to be sent or received by addresses on Planetfurry (which includes any host on this server), please email me at [email protected] or [email protected]. |
|
Back to top |
|
|
Elfen_Furry Moderator
Joined: 18 Jun 2002 Posts: 2601 Location: NYC NY
|
Posted: Sun Mar 07, 2004 4:59 pm Post subject: |
|
|
The one I ran to last year; which seems to be cropping up in many other places... is a spam generating virus.
If flasifies From: headers and generates To: addresses as well as email and other things. It uses open relays to send itself to the net.
If you get an email bounced back saying (message undeliverable) with your address as a From: , but its email that you never sent (Clue being, that its not your name on it), then its that virus on another system that spoofed your address...
Send it to your email isp, stating that you never sent it. They should take care of the rest. Though with yahoo!- they need to be yelled at more than once. _________________ SHARKS In The Gene Pool South of Kosovo!
*CHOMP!* |
|
Back to top |
|
|
Whip-lash Kneel before me... for I am Root!
Joined: 20 Nov 2000 Posts: 573
|
Posted: Sun Mar 07, 2004 5:19 pm Post subject: |
|
|
Elfen_Furry wrote: | ... Though with yahoo!- they need to be yelled at more than once. |
There are a few things that Yahoo needs to be yelled at about. I'm getting tired of their bad advertising techniques that trigger the server's virus/spam filters, as I'm sure many people with Yahoo Groups subscriptions can agree to. :\ |
|
Back to top |
|
|
Whip-lash Kneel before me... for I am Root!
Joined: 20 Nov 2000 Posts: 573
|
Posted: Wed Mar 10, 2004 8:49 pm Post subject: |
|
|
I received one of these phony notifications:
Code: | Dear user of e-mail server "Planetfurry.com",
Our main mailing server will be temporary unavaible for next two days,
to continue receiving mail in these days you have to configure our free
auto-forwarding service.
Further details can be obtained from attached file.
For security purposes the attached file is password protected. Password is "40403".
Sincerely,
The Planetfurry.com team http://www.planetfurry.com |
Geez... you can even see where the moron(s) who designed the email had places for interchangable strings of text! How utterly lame...
Apparrently it's also not getting marked as a virus because the zip file is password protected. It's actually the W32/Bagle.j@MM virus. I will be contacting McAffe tomorrow to see if they know of a workaround or fix, since their virus definition can detect it but not crack into a password protected zip.
Again, the Planetfurry Administrative Staff will never officially send programs or zip compressed programs through email. If at any time we were to need to officially send you a program, it would only be sent by someone in the "Planetfurry Administrative Staff" or [email protected], and would only be a link to an area on http://www.planetfurry.com. I will be discussing with the other members of the Planetfurry Administrative Staff about possibly having any posted files of this nature either PGP or GPG signed as well for added verification of authenticity.
Also, there is no group called "The Planetfurry.com team", and most definately no [email protected] email address. The group would be addressed as either the "Planetfurry Administrative Staff" or the "Planetfurry Admin Staff".
*uggh* It's been a looooong day... and I'm just getting tired of this crap. |
|
Back to top |
|
|
Fishburne Administrator
Joined: 23 Jul 2002 Posts: 596 Location: Plano, Texas
|
Posted: Thu Mar 11, 2004 11:19 am Post subject: |
|
|
Quote: | received one of these phony notifications:
SNIP
*uggh* It's been a looooong day... and I'm just getting tired of this crap. |
You have no idea.
Was infected by a FREAKING MORON at work. The entire Email system is fragged. He kept clicking on it and clicking on it...
Sigh _________________ "Do not Taunt Happy Fun God" -Cthulhu |
|
Back to top |
|
|
|