rec.autos.simulators

by **Joe Paloo** » Sun, 21 Sep 2003 06:59:04

Funny, the only address that I was getting all those "Microsoft
Update" messages with the virus attached were only coming to the email
address that I signed up on this newsgroup. And this is the ONLY
place I used that particular address. Good thing I use Norton because
it recognized the virus and stopped it from getting on my system.!

So if you are getting those fake messages from Microsoft, it probably
is through the email address you use for this newsgroup.

I changed the email address for this newsgroup and now I don't get
them anymore.

Joe Palooka

by **Jan Verschuere** » Sun, 21 Sep 2003 07:07:57

Coincidence, but using a working e-mail on a newsgroup is always a risk,
true.

Jan.
=---

by **Alan Bernard** » Sun, 21 Sep 2003 07:10:30

> Funny, the only address that I was getting all those "Microsoft
> Update" messages with the virus attached were only coming to the email
> address that I signed up on this newsgroup. And this is the ONLY
> place I used that particular address. Good thing I use Norton because
> it recognized the virus and stopped it from getting on my system.!

> So if you are getting those fake messages from Microsoft, it probably
> is through the email address you use for this newsgroup.

> I changed the email address for this newsgroup and now I don't get
> them anymore.

> Joe Palooka

Indeed. I've been getting loads of them, at one time they were coming in at
25-30 every half hour, all with 156k attachments. Of course I NEVER open up
attached files unless I know EXACTLY where they are coming from (i.e.,
someone told me a file is on its way and I know that someone), but they are
a nuisance nevertheless.

Aalnb

by **Joe Paloo** » Sun, 21 Sep 2003 07:18:05

>Coincidence, but using a working e-mail on a newsgroup is always a risk,
>true.

>Jan.
>=---

I agree with your statement about not using a working email,, Jan. It
wasn't really a working email, but the domain name in the suffix was.
And since I'm the administrator of my domain website, it came to me
through the "catch-all" system.
But I respectfully disagree with your thinking that it is a
coincidence. Because I changed the domain name in the suffix, and now
I'm not getting the messages anymore.

Joe

by **Goy Larse** » Sun, 21 Sep 2003 08:15:24

> Coincidence, but using a working e-mail on a newsgroup is always a risk,
> true.

I always post to NG's with a working addy, just not *my* working addy

<BEG>

Beers and cheers
(uncle) Goy
"goyl at nettx dot no"

http://www.theuspits.com

"A man is only as old as the woman he feels........"
--Groucho Marx--

by **John DiFoo** » Sun, 21 Sep 2003 08:14:47

On Fri, 19 Sep 2003 22:07:57 GMT, "Jan Verschueren"

>"Joe Palooka" wrote...

>> Funny, the only address that I was getting all
>> those "Microsoft Update" messages with the
>> virus attached were only coming to the email
>> address that I signed up on this newsgroup.
>> <snip>

>Coincidence, but using a working e-mail on a newsgroup is always a risk,
>true.

>Jan.
>=---

Now (as anyone can see) I "hide" my addy with a phony
one-is my real one hidden in my headers somewhere?
I'm also a victim...

JD

by **Jan Verschuere** » Sun, 21 Sep 2003 08:45:08

It has to be a coincidence due to the way this type of virus works, i.e.
using the addresses in the e-mail adressbook of the affected. I've not yet
heard of one culling headers of subscribed newsgroups for possible targets.

Jan.
=---

by **jason moy** » Sun, 21 Sep 2003 10:54:03

On Fri, 19 Sep 2003 23:45:08 GMT, "Jan Verschueren"

>It has to be a coincidence due to the way this type of virus works, i.e.
>using the addresses in the e-mail adressbook of the affected. I've not yet
>heard of one culling headers of subscribed newsgroups for possible targets.

No, someone apparently is harvesting email addresses from usenet and
attempting to spam people, but sending a virus instead:

----------------
Date: Fri, 19 Sep 2003 21:08:49 -0400

To: <snip long list of RAS posters>
Subject: Virus Detected

A message for this address contained a virus
and was not delivered.

Virus detected - Worm.Automat.AHB

by **Alan Bernard** » Sun, 21 Sep 2003 11:57:30

http://www.deepikaglobal.com/latestnews.asp?ncode=7000

by **gord** » Sun, 21 Sep 2003 12:10:15

> On Fri, 19 Sep 2003 22:07:57 GMT, "Jan Verschueren"

> >"Joe Palooka" wrote...

> >> Funny, the only address that I was getting all
> >> those "Microsoft Update" messages with the
> >> virus attached were only coming to the email
> >> address that I signed up on this newsgroup.
> >> <snip>

> >Coincidence, but using a working e-mail on a newsgroup is always a risk,
> >true.

> >Jan.
> >=---

> Now (as anyone can see) I "hide" my addy with a phony
> one-is my real one hidden in my headers somewhere?
> I'm also a victim...

> JD

I got one today too. I deleted it immediately.

I also fake my usenet e-mail addy.

by **elrik** » Sun, 21 Sep 2003 13:22:21

If I got 1 today I got 150.

<click> top of list
<shift click> bottom of list
<del> ;o)

Elrikk

by **ymenar** » Sun, 21 Sep 2003 17:06:28

> So if you are getting those fake messages from Microsoft, it probably
> is through the email address you use for this newsgroup.

Yes, it was very much proved that this is the case, in various of newsgroups
all across the Usenet. Bet it's the CoS again...

--
-- Fran?ois Mnard <ymenard>
-- http://ymenard.cjb.net/
-- This announcement is brought to you by the Shimago-Dominguez
Corporation - helping America into the New World...

by **Jan Verschuere** » Sun, 21 Sep 2003 17:22:14

No, spamblock does work, but if anyone who does have your real e-mail
address stored is silly enough to get himself infected, you get sent the
virus. Lots of silly people in Belgium judging by our inboxes here. <g>

Jan.
=---

by **Jan Verschuere** » Sun, 21 Sep 2003 17:22:14

Like I said, it's not the virus getting the addresses of usenet. Good to see
a spammer getting hit with a virus, pity it's not a more destructive one.

It's also not because Joe changed his return address he's not getting the
virus anymore. The "half working" address is still in the headers of his
earlier posts and once an address is harvested it remains in the hands of
the harvester who can still send him spam/virusses on it, so that part
remains coincidence as well.

Jan.
=---

by **Jan Verschuere** » Sun, 21 Sep 2003 17:27:28

The who?

Jan.
=---

rec.autos.simulators

AHA!

AHA!

AHA!

AHA!

AHA!

AHA!

AHA!

AHA!

AHA!

AHA!

AHA!

AHA!

AHA!

AHA!

AHA!

AHA!