Re: virus

[Michael Butash]

Somewhat kidding, look it up.

http://en.wikipedia.org/wiki/Back_Orifice_2000

-mb


On 11/15/2012 10:49 AM, Michael Havens wrote:

huh?
:-)~MIKE~(-:


On Thu, Nov 15, 2012 at 2:14 AM, Michael Butash mailto:mich...@butash.net>> wrote:

I think I have backorfice2k floating around in a zip file somewhere
still for nostalgia.  WinME might still be cool in nigeria, some
remote control for fun and profit.

-mb


On 11/14/2012 04:50 PM, Ryan Rix wrote:

Maybe keep spamming the list like this and someone will send you
another
game...

I really need to re-institute my email killfile, but you really
just provide
too much popcorn, I cannot fathom losing such entertaining posts
as these.

r.

On Fri 9 November 2012 10:17:29 Michael Havens wrote:

Well... back in 96 (before I ran linux) someone sent me a
'game'. I opened
the 'game' and my computer locked up and had to be restored.
That is
actually what I wanted :) Also, I would never send it to a
US based

scammer.


How do I discover where 'phx.gbl'. traceroute gets to 10
hops then gives

me:


 * * *

the last 'real' return I get is:

10ge-ten1-2.mia-89p-cor-2.__peer1.net

(216.187.124.129)  153.151 ms
   153.577 ms
154.080 ms

:-)~MIKE~(-:
On Fri, Nov 9, 2012 at 8:28 AM, Kevin
Friesmailto:ke...@fries-biro.com>>
  wrote:

Michael,

You are thinking far too one dimensionally.  What you
really need is the
routing and account numbers for an account owned by
Alcida.  Then let

them

steal away.  Let the jerks explain how they illegally
obtained this
information to Homeland Security.   Ha ha ha ha

I got your humor, guys ease up and stop taking thing so
seriously.

Kevin

On Nov 9, 2012 5:54 AM, "Michael
Havens"mailto:bmi...@gmail.com>>  wrote:

could someone send me a virus that I could 'share'
with all the thieves
that try to scam me?

:-)~MIKE~(-:
--__-
PLUG-discuss mailing list -
plug-disc...@lists.plug.__phoenix.az.us

To subscribe, unsubscribe, or to change your mail
settings:

http://lists.PLUG.phoenix.az.__us/mailman/listinfo/plug-__discuss




--__-
PLUG-discuss mailing list -
plug-disc...@lists.plug.__phoenix.az.us

To subscribe, unsubscribe, or to change your mail settings:

http://lists.PLUG.phoenix.az.__us/mailman/listinfo/plug-__discuss


--__-
PLUG-discuss mailing list - plug-disc...@lists.plug.__phoenix.az.us

To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.__us/mailman/listinfo/plug-__discuss




---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[Michael Havens]

huh?
:-)~MIKE~(-:


On Thu, Nov 15, 2012 at 2:14 AM, Michael Butash  wrote:

> I think I have backorfice2k floating around in a zip file somewhere still
> for nostalgia.  WinME might still be cool in nigeria, some remote control
> for fun and profit.
>
> -mb
>
>
> On 11/14/2012 04:50 PM, Ryan Rix wrote:
>
>> Maybe keep spamming the list like this and someone will send you another
>> game...
>>
>> I really need to re-institute my email killfile, but you really just
>> provide
>> too much popcorn, I cannot fathom losing such entertaining posts as these.
>>
>> r.
>>
>> On Fri 9 November 2012 10:17:29 Michael Havens wrote:
>>
>>> Well... back in 96 (before I ran linux) someone sent me a 'game'. I
>>> opened
>>> the 'game' and my computer locked up and had to be restored. That is
>>> actually what I wanted :) Also, I would never send it to a US based
>>>
>> scammer.
>>
>>>
>>> How do I discover where 'phx.gbl'. traceroute gets to 10 hops then gives
>>>
>> me:
>>
>>>
>>> * * *
>>>
>>> the last 'real' return I get is:
>>>
>>> 
>>> 10ge-ten1-2.mia-89p-cor-2.**peer1.net(216.187.124.129)
>>>   153.151 ms
>>>   153.577 ms
>>>154.080 ms
>>>
>>> :-)~MIKE~(-:
>>> On Fri, Nov 9, 2012 at 8:28 AM, Kevin Fries
>>>  wrote:
>>>
 Michael,

 You are thinking far too one dimensionally.  What you really need is the
 routing and account numbers for an account owned by Alcida.  Then let

>>> them
>>
>>> steal away.  Let the jerks explain how they illegally obtained this
 information to Homeland Security.   Ha ha ha ha

 I got your humor, guys ease up and stop taking thing so seriously.

 Kevin

 On Nov 9, 2012 5:54 AM, "Michael Havens"  wrote:

> could someone send me a virus that I could 'share' with all the thieves
> that try to scam me?
>
> :-)~MIKE~(-:
> --**-
> PLUG-discuss mailing list - 
> plug-disc...@lists.plug.**phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.**us/mailman/listinfo/plug-**discuss
>

 --**-
 PLUG-discuss mailing list - 
 plug-disc...@lists.plug.**phoenix.az.us
 To subscribe, unsubscribe, or to change your mail settings:
 http://lists.PLUG.phoenix.az.**us/mailman/listinfo/plug-**discuss

>>> --**-
> PLUG-discuss mailing list - 
> plug-disc...@lists.plug.**phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.**us/mailman/listinfo/plug-**discuss
>
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[Michael Butash]

I think I have backorfice2k floating around in a zip file somewhere 
still for nostalgia.  WinME might still be cool in nigeria, some remote 
control for fun and profit.


-mb


On 11/14/2012 04:50 PM, Ryan Rix wrote:

Maybe keep spamming the list like this and someone will send you another
game...

I really need to re-institute my email killfile, but you really just provide
too much popcorn, I cannot fathom losing such entertaining posts as these.

r.

On Fri 9 November 2012 10:17:29 Michael Havens wrote:

Well... back in 96 (before I ran linux) someone sent me a 'game'. I opened
the 'game' and my computer locked up and had to be restored. That is
actually what I wanted :) Also, I would never send it to a US based

scammer.


How do I discover where 'phx.gbl'. traceroute gets to 10 hops then gives

me:


* * *

the last 'real' return I get is:

10ge-ten1-2.mia-89p-cor-2.peer1.net (216.187.124.129)  153.151 ms
  153.577 ms
   154.080 ms

:-)~MIKE~(-:
On Fri, Nov 9, 2012 at 8:28 AM, Kevin Fries  wrote:

Michael,

You are thinking far too one dimensionally.  What you really need is the
routing and account numbers for an account owned by Alcida.  Then let

them

steal away.  Let the jerks explain how they illegally obtained this
information to Homeland Security.   Ha ha ha ha

I got your humor, guys ease up and stop taking thing so seriously.

Kevin

On Nov 9, 2012 5:54 AM, "Michael Havens"  wrote:

could someone send me a virus that I could 'share' with all the thieves
that try to scam me?

:-)~MIKE~(-:
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss


---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[Ryan Rix]

Maybe keep spamming the list like this and someone will send you another 
game...

I really need to re-institute my email killfile, but you really just provide 
too much popcorn, I cannot fathom losing such entertaining posts as these.

r.

On Fri 9 November 2012 10:17:29 Michael Havens wrote:
> Well... back in 96 (before I ran linux) someone sent me a 'game'. I opened
> the 'game' and my computer locked up and had to be restored. That is
> actually what I wanted :) Also, I would never send it to a US based 
scammer.
> 
> How do I discover where 'phx.gbl'. traceroute gets to 10 hops then gives 
me:
> 
>* * *
> 
> the last 'real' return I get is:
> 
>10ge-ten1-2.mia-89p-cor-2.peer1.net (216.187.124.129)  153.151 ms
>  153.577 ms
>   154.080 ms
> 
> :-)~MIKE~(-:
> On Fri, Nov 9, 2012 at 8:28 AM, Kevin Fries  wrote:
> > Michael,
> > 
> > You are thinking far too one dimensionally.  What you really need is the
> > routing and account numbers for an account owned by Alcida.  Then let 
them
> > steal away.  Let the jerks explain how they illegally obtained this
> > information to Homeland Security.   Ha ha ha ha
> > 
> > I got your humor, guys ease up and stop taking thing so seriously.
> > 
> > Kevin
> > 
> > On Nov 9, 2012 5:54 AM, "Michael Havens"  wrote:
> >> could someone send me a virus that I could 'share' with all the thieves
> >> that try to scam me?
> >> 
> >> :-)~MIKE~(-:
> >> ---
> >> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> >> To subscribe, unsubscribe, or to change your mail settings:
> >> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
> > 
> > ---
> > PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> > To subscribe, unsubscribe, or to change your mail settings:
> > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
-- 
Ryan Rix
http://rix.si

---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[Lisa Kachold]

Correction:

On Tue, Nov 13, 2012 at 2:42 PM, Stephen  wrote:

> nice kind of nulls that one out.
>
>
> On Tue, Nov 13, 2012 at 11:15 AM, Sam Kreimeyer wrote:
>
>> Step 1:
>> www.youtube.com/watch?v=mSmbdwCVl9E
>> http://www.backtrack-linux.org/
>>
>> Step 2:
>> Drop this in a shell (assuming the target can interpret bash) :(){ :|:&
>> };:
>>
>> Step 3:
>> Laugh heartily and disconnect
>>
>> Step 4:
>> Receive free silver bracelets from your local law FEDERAL
>> enforcement agency.
>>
>> For clarity, the above is a decidedly bad idea.
>>
>> ---
>> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
>> To subscribe, unsubscribe, or to change your mail settings:
>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>>
>
>
>
> --
> A mouse trap, placed on top of your alarm clock, will prevent you from
> rolling over and going back to sleep after you hit the snooze button.
>
> Stephen
>
> ---
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>



-- 


(503) 754-4452 Android
(623) 239-3392 Skype
(623) 688-3392 Google Voice
**
it-clowns.com
Chief Clown
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[Stephen]

nice kind of nulls that one out.


On Tue, Nov 13, 2012 at 11:15 AM, Sam Kreimeyer  wrote:

> Step 1:
> www.youtube.com/watch?v=mSmbdwCVl9E
> http://www.backtrack-linux.org/
>
> Step 2:
> Drop this in a shell (assuming the target can interpret bash) :(){ :|:& };:
>
> Step 3:
> Laugh heartily and disconnect
>
> Step 4:
> Receive free silver bracelets from your local law enforcement agency.
>
> For clarity, the above is a decidedly bad idea.
>
> ---
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>



-- 
A mouse trap, placed on top of your alarm clock, will prevent you from
rolling over and going back to sleep after you hit the snooze button.

Stephen
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[Sam Kreimeyer]

Step 1:
www.youtube.com/watch?v=mSmbdwCVl9E
http://www.backtrack-linux.org/

Step 2:
Drop this in a shell (assuming the target can interpret bash) :(){ :|:& };:

Step 3:
Laugh heartily and disconnect

Step 4:
Receive free silver bracelets from your local law enforcement agency.

For clarity, the above is a decidedly bad idea.
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: Spam control? (was RE: virus)

[Eric Shubert]

If spam is the problem, a better mail server can be the solution. 
Running your own mail server isn't nearly as complicated as it used to be.


QmailToaster (http://wiki.qmailtoaster.com) with spamdyke is a very good 
combination. Spamdyke rejects 90+% of spam without even receiving (or 
scanning) the message. The sanesecurity extensions to clamav catch the 
lion's share of phishing attempts. With this setup, I get <1 spam per day.


Disclaimer: I'm presently the project lead for QmailToaster.

--
-Eric 'shubes'

On 11/09/2012 12:40 PM, Derek Trotter wrote:

I don't remember the url, but a few years ago I found a site that had an
interesting  idea to fight those who try to con people into handing over
account information.  If you got one of these scam emaills, you would
submit the url the phishers included.  Their system would generate
random strings of text and submit these to the phishing site over and
over again. The result being the phishers would have lots of bogus
account data and would waste their time trying it.

On 11/09/2012 08:51 AM, Carruth, Rusty wrote:

As I remember (but remember whose memory we are talking about :-) -

I had 3 lists - those known to be spammers, those known to be ok, and
anybody else.  (Ok, so the 'anybody else' wasn't actually a LIST, it was
anybody not in the first 2 lists)

Known spammers got some huge delay (I think I finally ended up with 24
hours!), known safe senders got zero delay, and unknown got a few
seconds (or maybe I made it zero, I don't remember).

So non spammers got either zero or minimal delay.

If I can remember, I'll see if I still have that config file somewhere,
cause now you got me curious!

I should mention that there IS one 'small' downside - if you get ALL
your internet sockets tied up with spammers then you cannot receive (or
send) email (or do anything else network-related until one of the
sockets frees up).  I don't think I ever hit that limit, but then I only
do email for my family...

Rusty


-Original Message-

Rusty, how did tarpit and that delay time effect non spam users?

On Fri, Nov 9, 2012 at 8:37 AM, Carruth, Rusty
  wrote:



I've tried running that thing that keeps spammers busy trying to

deliver the email (tarpit?  I cannot remember - the idea is you keep
telling unknown MTAs 'hold on a moment' for a while - say an hour or
more, thus keeping their delivery rate low.  I should mention that at
home I run my own MTA, so it was an option for me.  Anybody using

their

ISP's MTA (or gmail, or...) cannot do this).  The problem is that you
need a LOT of people running that for it to do much good in spam
reduction overall, and I don't' know if it reduced mine (but it was
satisfying to look at the headers and see that couple of hour delay).
...

---
PLUG-discuss mailing list -PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss








---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: Spam control? (was RE: virus)

[Derek Trotter]

I don't remember the url, but a few years ago I found a site that had an 
interesting  idea to fight those who try to con people into handing over 
account information.  If you got one of these scam emaills, you would 
submit the url the phishers included.  Their system would generate 
random strings of text and submit these to the phishing site over and 
over again. The result being the phishers would have lots of bogus 
account data and would waste their time trying it.


On 11/09/2012 08:51 AM, Carruth, Rusty wrote:

As I remember (but remember whose memory we are talking about :-) -

I had 3 lists - those known to be spammers, those known to be ok, and
anybody else.  (Ok, so the 'anybody else' wasn't actually a LIST, it was
anybody not in the first 2 lists)

Known spammers got some huge delay (I think I finally ended up with 24
hours!), known safe senders got zero delay, and unknown got a few
seconds (or maybe I made it zero, I don't remember).

So non spammers got either zero or minimal delay.

If I can remember, I'll see if I still have that config file somewhere,
cause now you got me curious!

I should mention that there IS one 'small' downside - if you get ALL
your internet sockets tied up with spammers then you cannot receive (or
send) email (or do anything else network-related until one of the
sockets frees up).  I don't think I ever hit that limit, but then I only
do email for my family...

Rusty


-Original Message-

Rusty, how did tarpit and that delay time effect non spam users?

On Fri, Nov 9, 2012 at 8:37 AM, Carruth, Rusty
 wrote:



I've tried running that thing that keeps spammers busy trying to

deliver the email (tarpit?  I cannot remember - the idea is you keep
telling unknown MTAs 'hold on a moment' for a while - say an hour or
more, thus keeping their delivery rate low.  I should mention that at
home I run my own MTA, so it was an option for me.  Anybody using

their

ISP's MTA (or gmail, or...) cannot do this).  The problem is that you
need a LOT of people running that for it to do much good in spam
reduction overall, and I don't' know if it reduced mine (but it was
satisfying to look at the headers and see that couple of hour delay).
...

---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss



---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[Michael Havens]

:-)~MIKE~(-:


On Fri, Nov 9, 2012 at 6:08 AM, Eric Oyen  wrote:

> how about lets not and say we did. frankly, this is either silly  or a
> joke in very poor taste.  If you are being serious, then you deserve
> whatever you get.
>
> I spend entirely too much time trying to disinfect machines on account of
> clueless user actions. the pay is good, but I grow tired of having to have
> to educate these users time and again.
>
> so, I ask that you PLEASE think about you are asking.
>
> eric oyen (member of the Technomage Order of the Hawke)
> On Nov 9, 2012, at 5:54 AM, Michael Havens wrote:
>
> > could someone send me a virus that I could 'share' with all the thieves
> that try to scam me?
> > :-)~MIKE~(-:
> > ---
> > PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> > To subscribe, unsubscribe, or to change your mail settings:
> > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>
> ---
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[Lisa Kachold]

Hello All!

On Fri, Nov 9, 2012 at 10:55 AM, Bob Elzer  wrote:

>  I too read frustration and sarcasm in his post
>
> It did remind me of one linux operator that got tired of rogue machines
> probing his linux box trying to infect it with windows exploits. One in
> particular, that I can't remember now.
>
> He wrote a script that targeted that particular exploit and would infect
> the machine attacking him and actually clean the exploit off the infected
> machine and then remove itself.
>
> Even so, it was illegal for him to do that, but I do wish someone would
> allow this kind of script to clean up all the infected machines.
>

That's an interesting response, however fraught with consequences.

First year computer science students are often asked, as flow charting
exercise, to model "ethics" in society.  Golden Rule, Turn the Other Cheek,
Hit Back with a Bigger Hammer, are all modeled into a virtual society.
 Interestingly in this exercise, which do you think was found to be most
successful?

Yes, it is "Hit Back with a Bigger Hammer"

Of course, the only part that was not modeled was the consequences of the
law, assuming that if there was no law available to resolve the problem,
there would be no consequences.

There are things that can be done with regards to various types of scammers:

1) These scams can be reported to various authorities:

http://www.ripoffreport.com/directory/global-resorts-network.aspx

http://www.consumerfraudreporting.org/FBI_LocalOffices.php

2) Tracking via cookies

Setting tracking cookies in response email can provide additional
information related to the end source.   Many people will be surprised to
learn they are actually originating in the US but hopscotching to other
countries to reduce the chances of their arrest.

3) Depending on the scam, scam the scammers (aka scambaiting):

http://www.troyhunt.com/2012/02/scamming-scammers-catching-virus-call.html

http://www.419eater.com/

There are various discussions of how to straddle that thin grey line
between joining the criminal and staying in the solution.



>
> On 11/9/2012 8:27 AM, keith smith wrote:
>
>
> I think he was just blowing off some steam.  If so no harm no foul.
>
> 
> Keith Smith
>
> --- On *Fri, 11/9/12, Eric Shubert  *wrote:
>
>
> From: Eric Shubert  
> Subject: Re: virus
> To: "Main PLUG discussion list" 
> 
> Date: Friday, November 9, 2012, 8:18 AM
>
> On 11/09/2012 05:54 AM, Michael Havens wrote:
> > could someone send me a virus that I could 'share' with all the thieves
> > that try to scam me?
> > :-)~MIKE~(-:
> >
> >
>
> Not a prudent approach. What goes around comes around.
>
> --
> -Eric 'shubes'
> ---
> PLUG-discuss mailing list - 
> PLUG-discuss@lists.plug.phoenix.az.us<http://mc/compose?to=PLUG-discuss@lists.plug.phoenix.az.us>
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>
>
>
>
> --
(503) 754-4452 Android
(623) 239-3392 Skype
(623) 688-3392 Google Voice
**
it-clowns.com
Chief Clown
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[Bob Elzer]

I too read frustration and sarcasm in his post

It did remind me of one linux operator that got tired of rogue machines 
probing his linux box trying to infect it with windows exploits. One in 
particular, that I can't remember now.


He wrote a script that targeted that particular exploit and would infect 
the machine attacking him and actually clean the exploit off the 
infected machine and then remove itself.


Even so, it was illegal for him to do that, but I do wish someone would 
allow this kind of script to clean up all the infected machines.



On 11/9/2012 8:27 AM, keith smith wrote:


I think he was just blowing off some steam.  If so no harm no foul.


Keith Smith

--- On *Fri, 11/9/12, Eric Shubert //* wrote:


From: Eric Shubert 
Subject: Re: virus
To: "Main PLUG discussion list"

Date: Friday, November 9, 2012, 8:18 AM

On 11/09/2012 05:54 AM, Michael Havens wrote:
> could someone send me a virus that I could 'share' with all the
thieves
> that try to scam me?
> :-)~MIKE~(-:
>
>

Not a prudent approach. What goes around comes around.

-- 
-Eric 'shubes'

---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us

To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss



---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss


---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[Michael Havens]

Well... back in 96 (before I ran linux) someone sent me a 'game'. I opened
the 'game' and my computer locked up and had to be restored. That is
actually what I wanted :) Also, I would never send it to a US based scammer.

How do I discover where 'phx.gbl'. traceroute gets to 10 hops then gives me:

   * * *

the last 'real' return I get is:

   10ge-ten1-2.mia-89p-cor-2.peer1.net (216.187.124.129)  153.151 ms
 153.577 ms
  154.080 ms

:-)~MIKE~(-:


On Fri, Nov 9, 2012 at 8:28 AM, Kevin Fries  wrote:

> Michael,
>
> You are thinking far too one dimensionally.  What you really need is the
> routing and account numbers for an account owned by Alcida.  Then let them
> steal away.  Let the jerks explain how they illegally obtained this
> information to Homeland Security.   Ha ha ha ha
>
> I got your humor, guys ease up and stop taking thing so seriously.
>
> Kevin
> On Nov 9, 2012 5:54 AM, "Michael Havens"  wrote:
>
>> could someone send me a virus that I could 'share' with all the thieves
>> that try to scam me?
>> :-)~MIKE~(-:
>>
>> ---
>> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
>> To subscribe, unsubscribe, or to change your mail settings:
>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>>
>
> ---
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

RE: Spam control? (was RE: virus)

[Carruth, Rusty]

As I remember (but remember whose memory we are talking about :-) -

I had 3 lists - those known to be spammers, those known to be ok, and
anybody else.  (Ok, so the 'anybody else' wasn't actually a LIST, it was
anybody not in the first 2 lists)

Known spammers got some huge delay (I think I finally ended up with 24
hours!), known safe senders got zero delay, and unknown got a few
seconds (or maybe I made it zero, I don't remember).

So non spammers got either zero or minimal delay.

If I can remember, I'll see if I still have that config file somewhere,
cause now you got me curious!

I should mention that there IS one 'small' downside - if you get ALL
your internet sockets tied up with spammers then you cannot receive (or
send) email (or do anything else network-related until one of the
sockets frees up).  I don't think I ever hit that limit, but then I only
do email for my family...

Rusty

> -Original Message-
> 
> Rusty, how did tarpit and that delay time effect non spam users?
> 
> On Fri, Nov 9, 2012 at 8:37 AM, Carruth, Rusty
>  wrote:
> > 
> >
> > I've tried running that thing that keeps spammers busy trying to
> deliver the email (tarpit?  I cannot remember - the idea is you keep
> telling unknown MTAs 'hold on a moment' for a while - say an hour or
> more, thus keeping their delivery rate low.  I should mention that at
> home I run my own MTA, so it was an option for me.  Anybody using
their
> ISP's MTA (or gmail, or...) cannot do this).  The problem is that you
> need a LOT of people running that for it to do much good in spam
> reduction overall, and I don't' know if it reduced mine (but it was
> satisfying to look at the headers and see that couple of hour delay).
> ...

---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: Spam control? (was RE: virus)

[Stephen]

Rusty, how did tarpit and that delay time effect non spam users?

On Fri, Nov 9, 2012 at 8:37 AM, Carruth, Rusty
 wrote:
> Some time back I thought the best solution would be to form a co-op.  Members 
> of the co-op would run some sort of program to detect spammers, and then join 
> together in a DOS attack on the spammer's MTA.  Detection should be pretty 
> easy, I'd think, with minimal false positives.
>
> When I thought of that, it wasn't illegal.  It is now, so I've dropped 
> thinking about it, but it would have reduced the spam.  Of course, the 
> collateral damage (to clueless users whose machines had been 0wn3d, as a 
> minimum) would have been pretty high, and I'm not sure they would have been 
> able to figure out why their systems broke down.  Probably would have 
> required a pretty big education program, as it were, to get people to either 
> (1) stop using the primary virus propagator of the universe (I am, of course, 
> referring to a certain operating system); (2) get off the internet; or, (3) 
> keep their virus scanners up to date.  Assuming, of course, that most spam 
> comes from 0wn3d machines.  Not sure that's a valid assumption.
>
> I've tried running that thing that keeps spammers busy trying to deliver the 
> email (tarpit?  I cannot remember - the idea is you keep telling unknown MTAs 
> 'hold on a moment' for a while - say an hour or more, thus keeping their 
> delivery rate low.  I should mention that at home I run my own MTA, so it was 
> an option for me.  Anybody using their ISP's MTA (or gmail, or...) cannot do 
> this).  The problem is that you need a LOT of people running that for it to 
> do much good in spam reduction overall, and I don't' know if it reduced mine 
> (but it was satisfying to look at the headers and see that couple of hour 
> delay).
>
> I finally gave up and just kept changing my email address (and I also used 
> the spam detector in my email program).
>
> Rusty
>
>
>> -Original Message-
>> On 11/09/2012 05:54 AM, Michael Havens wrote:
>> > could someone send me a virus that I could 'share' with all the
>> > thieves that try to scam me?
>> > :-)~MIKE~(-:
>>
>> Not a prudent approach. What goes around comes around.
>>
>
> ---
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss



-- 
A mouse trap, placed on top of your alarm clock, will prevent you from
rolling over and going back to sleep after you hit the snooze button.

Stephen
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Spam control? (was RE: virus)

[Carruth, Rusty]

Some time back I thought the best solution would be to form a co-op.  Members 
of the co-op would run some sort of program to detect spammers, and then join 
together in a DOS attack on the spammer's MTA.  Detection should be pretty 
easy, I'd think, with minimal false positives.

When I thought of that, it wasn't illegal.  It is now, so I've dropped thinking 
about it, but it would have reduced the spam.  Of course, the collateral damage 
(to clueless users whose machines had been 0wn3d, as a minimum) would have been 
pretty high, and I'm not sure they would have been able to figure out why their 
systems broke down.  Probably would have required a pretty big education 
program, as it were, to get people to either (1) stop using the primary virus 
propagator of the universe (I am, of course, referring to a certain operating 
system); (2) get off the internet; or, (3) keep their virus scanners up to 
date.  Assuming, of course, that most spam comes from 0wn3d machines.  Not sure 
that's a valid assumption.

I've tried running that thing that keeps spammers busy trying to deliver the 
email (tarpit?  I cannot remember - the idea is you keep telling unknown MTAs 
'hold on a moment' for a while - say an hour or more, thus keeping their 
delivery rate low.  I should mention that at home I run my own MTA, so it was 
an option for me.  Anybody using their ISP's MTA (or gmail, or...) cannot do 
this).  The problem is that you need a LOT of people running that for it to do 
much good in spam reduction overall, and I don't' know if it reduced mine (but 
it was satisfying to look at the headers and see that couple of hour delay).  

I finally gave up and just kept changing my email address (and I also used the 
spam detector in my email program).

Rusty

 
> -Original Message-
> On 11/09/2012 05:54 AM, Michael Havens wrote:
> > could someone send me a virus that I could 'share' with all the
> > thieves that try to scam me?
> > :-)~MIKE~(-:
> 
> Not a prudent approach. What goes around comes around.
> 

---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[Kevin Fries]

Michael,

You are thinking far too one dimensionally.  What you really need is the
routing and account numbers for an account owned by Alcida.  Then let them
steal away.  Let the jerks explain how they illegally obtained this
information to Homeland Security.   Ha ha ha ha

I got your humor, guys ease up and stop taking thing so seriously.

Kevin
On Nov 9, 2012 5:54 AM, "Michael Havens"  wrote:

> could someone send me a virus that I could 'share' with all the thieves
> that try to scam me?
> :-)~MIKE~(-:
>
> ---
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[keith smith]

I think he was just blowing off some steam.  If so no harm no foul.



Keith Smith

--- On Fri, 11/9/12, Eric Shubert  wrote:

From: Eric Shubert 
Subject: Re: virus
To: "Main PLUG discussion list" 
Date: Friday, November 9, 2012, 8:18 AM

On 11/09/2012 05:54 AM, Michael Havens wrote:
> could someone send me a virus that I could 'share' with all the thieves
> that try to scam me?
> :-)~MIKE~(-:
>
>

Not a prudent approach. What goes around comes around.

-- 
-Eric 'shubes'
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[Eric Shubert]

On 11/09/2012 05:54 AM, Michael Havens wrote:

could someone send me a virus that I could 'share' with all the thieves
that try to scam me?
:-)~MIKE~(-:




Not a prudent approach. What goes around comes around.

--
-Eric 'shubes'
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[Stephen]

Not only is it a bad idea from the damage done, likely to people who
do not know better. but it is illegal.

On Fri, Nov 9, 2012 at 6:08 AM, Eric Oyen  wrote:
> how about lets not and say we did. frankly, this is either silly  or a joke 
> in very poor taste.  If you are being serious, then you deserve whatever you 
> get.
>
> I spend entirely too much time trying to disinfect machines on account of 
> clueless user actions. the pay is good, but I grow tired of having to have to 
> educate these users time and again.
>
> so, I ask that you PLEASE think about you are asking.
>
> eric oyen (member of the Technomage Order of the Hawke)
> On Nov 9, 2012, at 5:54 AM, Michael Havens wrote:
>
>> could someone send me a virus that I could 'share' with all the thieves that 
>> try to scam me?
>> :-)~MIKE~(-:
>> ---
>> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
>> To subscribe, unsubscribe, or to change your mail settings:
>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>
> ---
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss



-- 
A mouse trap, placed on top of your alarm clock, will prevent you from
rolling over and going back to sleep after you hit the snooze button.

Stephen
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: virus

[Eric Oyen]

how about lets not and say we did. frankly, this is either silly  or a joke in 
very poor taste.  If you are being serious, then you deserve whatever you get. 

I spend entirely too much time trying to disinfect machines on account of 
clueless user actions. the pay is good, but I grow tired of having to have to 
educate these users time and again.

so, I ask that you PLEASE think about you are asking.

eric oyen (member of the Technomage Order of the Hawke)
On Nov 9, 2012, at 5:54 AM, Michael Havens wrote:

> could someone send me a virus that I could 'share' with all the thieves that 
> try to scam me?
> :-)~MIKE~(-:
> ---
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: Virus info!

[koder]

There is a feature in XP to clear out temp files. Either run it or clean
them out manually. There are several.

Don't forget the Restore feature. That is notorious for filling up a
hard drive. if you turn Restore off, restart computer and defrag you can
recover the space.

Have fun

Harold


On Sun, 2008-05-25 at 08:42 -0700, Jason Spatafore wrote:
> On Sun, 2008-05-25 at 08:31 -0700, Jason Spatafore wrote:
> > On Sun, 2008-05-25 at 08:18 -0700, Jason Spatafore wrote:
> > > un it...any spyware eating your system?
> > > Download autoruns and check it...any suspicious entries there?
> > > 
> > > Run chkdisk /r and allow a full disk scan to take place. Any lost
> > > clusters? 
> 
> This will be my last email on the subject. :) 
> 
> This may seem like a "dumb thing" to ask but there are two more things
> to check.
> 
> 1. Did you empty the recycle bin?
> 2. Check the recycle bin settings. If it is set to take more than 10% of
> your space, that could be where your problem is. Move the slider down.
> (The space gets reserved for the recycle bin.)
> 
> That's all I have. Have a great weekend! 
> 
> ---
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: Virus info!

[Jason Spatafore]

On Sun, 2008-05-25 at 08:31 -0700, Jason Spatafore wrote:
> On Sun, 2008-05-25 at 08:18 -0700, Jason Spatafore wrote:
> > un it...any spyware eating your system?
> > Download autoruns and check it...any suspicious entries there?
> > 
> > Run chkdisk /r and allow a full disk scan to take place. Any lost
> > clusters? 

This will be my last email on the subject. :) 

This may seem like a "dumb thing" to ask but there are two more things
to check.

1. Did you empty the recycle bin?
2. Check the recycle bin settings. If it is set to take more than 10% of
your space, that could be where your problem is. Move the slider down.
(The space gets reserved for the recycle bin.)

That's all I have. Have a great weekend! 

---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: Virus info!

[Jason Spatafore]

On Sun, 2008-05-25 at 08:18 -0700, Jason Spatafore wrote:
> un it...any spyware eating your system?
> Download autoruns and check it...any suspicious entries there?
> 
> Run chkdisk /r and allow a full disk scan to take place. Any lost
> clusters? 

Oh, another killer app for Windows to check startups is HijackThis! It
searches all kinds of places.

Clear your browser cache as well. Each cookie is stored as a small
file...say 300bytes but takes up a cluster on your hard drive, which
could be say 512 byte clusters. So, that could be it too.

If other people can use your computer, you will need to check all the
users. Check for programs like Limewire, Azureus, or any other file
sharing type program. People will often not delete the files they
download. 

There's a lot of possibilities. I am throwing many at you. 

---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: Virus info!

[Jason Spatafore]

On Sun, 2008-05-25 at 08:11 -0700, mike enriquez wrote:
> Linux or winlow is not a important as why would a hard drive fill up.
> Whatever is causing this is very well hidden. I would imagine this could 
> happen in any OS.
> Thanks
> Mike

I made a funny. Won't engage in the whole debate that is being proposed.

In Windows, bring up task manager...what's running? Open regedit and
search the following keys...anything suspicious?
HKEY-> Local Machine -> Software -> Microsoft -> Windows -> Run
HKEY-> Local Machine -> Software -> Microsoft -> Windows -> Run
Services
HKEY-> Local Machine -> Software -> Microsoft -> Windows -> RunOnce
HKEY-> Current User -> Software -> Microsoft -> Windows -> Run
HKEY-> Current User -> Software -> Microsoft -> Windows -> Run Services
HKEY-> Current User -> Software -> Microsoft -> Windows -> RunOnce

Click on start - run - services.msc

Any odd services there?

Download spybot and run it...any spyware eating your system?
Download autoruns and check it...any suspicious entries there?

Run chkdisk /r and allow a full disk scan to take place. Any lost
clusters? 

When done, do a defrag to see if you can clear up space due to
organization of disk.

There are many places to check. This could be a real intensive process
and will take up your memorial day weekend.

Yes, something like this can happen to any machine...this past week, I
had a situation where I filled up the root partition and my fstab file
got corrupted. That was a 2 day problem. 

The difference is: I DID IT, not something else. Try all those items
though. It will take awhile but you gotta see what is really going on. 


---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: Virus info!

[mike enriquez]

Linux or winlow is not a important as why would a hard drive fill up.
Whatever is causing this is very well hidden. I would imagine this could 
happen in any OS.
Thanks
Mike
- Original Message - 
From: "Jason Spatafore" <[EMAIL PROTECTED]>
To: "Main PLUG discussion list" 
Sent: Sunday, May 25, 2008 8:04 AM
Subject: Re: Virus info!


>
>> Windows?
>>
>
> Of course it's Windows. The word "Virus" gives that one away. :)
>
> ---
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss 

---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: Virus info!

[Jason Spatafore]

> Windows?
> 

Of course it's Windows. The word "Virus" gives that one away. :) 

---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: Virus info!

[mike enriquez]

The swap file is in the "C" drive and is about 800MB in size.
Any ideas?
Thanks
Mike Enriquez
- Original Message - 
From: "KevinO" <[EMAIL PROTECTED]>
To: "Main PLUG discussion list" 
Sent: Saturday, May 24, 2008 11:50 PM
Subject: Re: Virus info!


> mike enriquez wrote:
>> Has anyone on the list experienced a virus that fills up your "C" drive. 
>> I have a computer that has 1% free space and when you look at the 
>> programs on the "C" drive
>> they don't up to much. I ran an antivirus software but it found nothing. 
>> I have resized the "C" drive and I hope to go in and see what I can move 
>> around or delete.
>> I want to see if the space on the hard drive that free up will get filled 
>> up. If the computer fills up this space on its own I have no idea what 
>> kind of virus
>> I could have. Any ideas?
> >
> Windows?
>
> Where is your swap file? How big is it?
>
> -- 
> KevinO
> ---
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
> 

---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

Re: Virus info!

[KevinO]

mike enriquez wrote:
> Has anyone on the list experienced a virus that fills up your "C" drive. I 
> have a computer that has 1% free space and when you look at the programs on 
> the "C" drive
> they don't up to much. I ran an antivirus software but it found nothing.  I 
> have resized the "C" drive and I hope to go in and see what I can move around 
> or delete.
> I want to see if the space on the hard drive that free up will get filled up. 
> If the computer fills up this space on its own I have no idea what kind of 
> virus 
> I could have. Any ideas?
 >
Windows?

Where is your swap file? How big is it?

-- 
KevinO
---
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss