BEWARE--Someone is getting e-mail addr. from this forum to add to SPAM list

My e-mail box has been bombarded with Virus loaded e-mails
since I first used this forum a couple of months ago. I
suspected that someone took my e-mail address and added it
to their spam list.

So this morning, I created a new e-mail user and address
(loraine), posted to this forum, and an hour later
received the BOGUS MICROSOFT SECURITY bulletin that has
the SWEN virus attached at my new e-mail address.

NO ONE else had this e-mail address. And I have 4 other e-
mail accounts with my ISP that I have NOT used on this
forum and they have not received the Bogus e-mails. So,
this forum, is where this person/group is picking up e-
mails and adding them to the SPAM list to send out one of
the latest virus threats.
Beware--Do not give out your e-mail address on these
newsgroups.
Loraine

Dick
Sun Oct 05 15:11:23 CDT 2003

This is not a newsflash here. It's certainly not a newsflash to anybody who
has posted to any Usenet newsgroups with a valid email address anytime
recently.

Speaking of off-topic.

"Loraine" <loraine222@bellsouth.net> wrote in message
news:047a01c38b7b$d8cd7e50$a401280a@phx.gbl...
> My e-mail box has been bombarded with Virus loaded e-mails
> since I first used this forum a couple of months ago. I
> suspected that someone took my e-mail address and added it
> to their spam list.
>
> So this morning, I created a new e-mail user and address
> (loraine), posted to this forum, and an hour later
> received the BOGUS MICROSOFT SECURITY bulletin that has
> the SWEN virus attached at my new e-mail address.
>
> NO ONE else had this e-mail address. And I have 4 other e-
> mail accounts with my ISP that I have NOT used on this
> forum and they have not received the Bogus e-mails. So,
> this forum, is where this person/group is picking up e-
> mails and adding them to the SPAM list to send out one of
> the latest virus threats.
> Beware--Do not give out your e-mail address on these
> newsgroups.
> Loraine

Bob
Sun Oct 05 15:17:22 CDT 2003

Loraine, this is old old news. The spammers have been using sweeper software
across all Usenet Newsgroups - not just this one for something like a month.
The sweeper software looks for anything that looks like an email address and
adds it to it's try list.
--
Regards
Bob Peel,
Microsoft MVP - Money

Hints/Tips
http://support.microsoft.com/default.aspx?scid=fh;EN-GB;mny
UK Wishes/Suggestions
mnyukwsh@microsoft.com

"Loraine" <loraine222@bellsouth.net> wrote in message
news:047a01c38b7b$d8cd7e50$a401280a@phx.gbl...
> My e-mail box has been bombarded with Virus loaded e-mails
> since I first used this forum a couple of months ago. I
> suspected that someone took my e-mail address and added it
> to their spam list.
>
> So this morning, I created a new e-mail user and address
> (loraine), posted to this forum, and an hour later
> received the BOGUS MICROSOFT SECURITY bulletin that has
> the SWEN virus attached at my new e-mail address.
>
> NO ONE else had this e-mail address. And I have 4 other e-
> mail accounts with my ISP that I have NOT used on this
> forum and they have not received the Bogus e-mails. So,
> this forum, is where this person/group is picking up e-
> mails and adding them to the SPAM list to send out one of
> the latest virus threats.
> Beware--Do not give out your e-mail address on these
> newsgroups.
> Loraine

Loraine
Sun Oct 05 15:35:16 CDT 2003

If this is OLD news, then why was I not informed before
giving out my e-mail address to this forum? Should there
not have been a warning or something when I entered my
address. I have contacted Microsoft and my ISP and when
they responded, THEY were not aware of this problem--(or
they didn't inform me). I have been given every excuse in
the book to why I am receiving so many of these virus
loaded e-mails. I only figured out this morning where it
was coming from. Someone needs to warn people about this.

If everyone is out there to help, why did no one tell me
this before now? Telling me this is OLD NEWS, does not
help anyone.
Loraine



>-----Original Message-----
>This is not a newsflash here. It's certainly not a
newsflash to anybody who
>has posted to any Usenet newsgroups with a valid email
address anytime
>recently.
>
>Speaking of off-topic.
>
>"Loraine" <loraine222@bellsouth.net> wrote in message
>news:047a01c38b7b$d8cd7e50$a401280a@phx.gbl...
>> My e-mail box has been bombarded with Virus loaded e-
mails
>> since I first used this forum a couple of months ago. I
>> suspected that someone took my e-mail address and added
it
>> to their spam list.
>>
>> So this morning, I created a new e-mail user and address
>> (loraine), posted to this forum, and an hour later
>> received the BOGUS MICROSOFT SECURITY bulletin that has
>> the SWEN virus attached at my new e-mail address.
>>
>> NO ONE else had this e-mail address. And I have 4 other
e-
>> mail accounts with my ISP that I have NOT used on this
>> forum and they have not received the Bogus e-mails. So,
>> this forum, is where this person/group is picking up e-
>> mails and adding them to the SPAM list to send out one
of
>> the latest virus threats.
>> Beware--Do not give out your e-mail address on these
>> newsgroups.
>> Loraine
>
>
>.
>

Loraine
Sun Oct 05 15:57:55 CDT 2003

SO...How do I get my name off of their SPAM list???

I am really tired of the 10-15 virus e-mails I am
receiving each day. This is not just ordinary junk mail,
but e-mail that keeps my Norton very busy. Loraine

>-----Original Message-----
>Loraine, this is old old news. The spammers have been
using sweeper software
>across all Usenet Newsgroups - not just this one for
something like a month.
>The sweeper software looks for anything that looks like
an email address and
>adds it to it's try list.
>--
>Regards
>Bob Peel,
>Microsoft MVP - Money
>
> Hints/Tips
> http://support.microsoft.com/default.aspx?
scid=fh;EN-GB;mny
> UK Wishes/Suggestions
> mnyukwsh@microsoft.com
>
>"Loraine" <loraine222@bellsouth.net> wrote in message
>news:047a01c38b7b$d8cd7e50$a401280a@phx.gbl...
>> My e-mail box has been bombarded with Virus loaded e-
mails
>> since I first used this forum a couple of months ago. I
>> suspected that someone took my e-mail address and added
it
>> to their spam list.
>>
>> So this morning, I created a new e-mail user and address
>> (loraine), posted to this forum, and an hour later
>> received the BOGUS MICROSOFT SECURITY bulletin that has
>> the SWEN virus attached at my new e-mail address.
>>
>> NO ONE else had this e-mail address. And I have 4 other
e-
>> mail accounts with my ISP that I have NOT used on this
>> forum and they have not received the Bogus e-mails. So,
>> this forum, is where this person/group is picking up e-
>> mails and adding them to the SPAM list to send out one
of
>> the latest virus threats.
>> Beware--Do not give out your e-mail address on these
>> newsgroups.
>> Loraine
>
>
>.
>

Scott
Sun Oct 05 16:18:55 CDT 2003


"Loraine" <loraine222@bellsouth.net> wrote in message
news:047a01c38b7b$d8cd7e50$a401280a@phx.gbl...
> My e-mail box has been bombarded with Virus loaded e-mails
> since I first used this forum a couple of months ago. I
> suspected that someone took my e-mail address and added it
> to their spam list.
>
> So this morning, I created a new e-mail user and address
> (loraine), posted to this forum, and an hour later
> received the BOGUS MICROSOFT SECURITY bulletin that has
> the SWEN virus attached at my new e-mail address.
>
> NO ONE else had this e-mail address. And I have 4 other e-
> mail accounts with my ISP that I have NOT used on this
> forum and they have not received the Bogus e-mails. So,
> this forum, is where this person/group is picking up e-
> mails and adding them to the SPAM list to send out one of
> the latest virus threats.
> Beware--Do not give out your e-mail address on these
> newsgroups.
> Loraine

There is no person or group doing this. Swen.A is a worm designed to read
addresses from selected news servers. Anyone that gets infected with Swen.A
adds to the problem, particularly if a broadband connection is available.
Swen.A also uses the more traditional vectors of address books and open
fileshares.

Although garden-variety spammers have harvested addresses from Usenet for
years, this is the first time I'm aware of that a virus/worm/etc has done
this.

Once enough ppl were infected, the traffic generated by infected computers
had the effect of a distributed denial-of-service attack. Some news admins
had to configure their servers to use a port other than 119 for NNTP to
block Swen.A traffic. Others had to assign usernames and passwords for
their users.

I read about the details over in news.admin.net-abuse.usenet. More than one
news admin wasn't happy that the antivirus community had reverse-engineered
Swen.A, knew what it did, but apparently made no effort to contact the
admins of the targeted news servers. It appears news admins contacted each
other, once they realized what was happening.

It appears that Microsoft's solution was to expire all messages earlier than
September, which cut down the number of addresses that could be harvested,
which reduced wasted bandwidth, which at least makes it where I can connect
to the server and download messages again, which I have been unable to do
for the last few weeks. Judging from the lack of new messages, I'm not the
only one that had difficulties accessing msnews.microsoft.com. Even the web
interface had trouble displaying messages.

This is just the beginning. Now that one person has written a worm that
does this, I'm sure others will follow. I wouldn't be surprised if news
admins have to begin weekly port rotation, or a weekly username/password, in
order to block future worms that operate like this.

--
Scott Tyler
agent_scotty-at-hotmail-dot-com

Scott
Sun Oct 05 16:26:29 CDT 2003


"Loraine" <loraine222@bellsouth.net> wrote in message
news:154c01c38b83$59466c70$a001280a@phx.gbl...
> SO...How do I get my name off of their SPAM list???
>
> I am really tired of the 10-15 virus e-mails I am
> receiving each day. This is not just ordinary junk mail,
> but e-mail that keeps my Norton very busy. Loraine
>

There's nothing you can do. If there are 100 infected computers with
broadband connections out there, they are going to keep grabbing addresses
from this news server (as well as the other news servers targeted in
Swen.A's dat file) and keep sending these emails.

Only way to stop this is for the infected computers to be cleaned (or at
least disconnected from the internet), or for Microsoft (and other news
admins whose servers are targeted by Swen.A) to block port 119, or block
anonymous access. Either of those solutions means that Microsoft would have
to post instructions for everyone to adjust their newsreader to use a
different port, or to use a username and password.

It sucks, but that's the way it is.

--
Scott Tyler
agent_scotty-at-hotmail-dot-com

via_newsgroup
Sun Oct 05 16:44:05 CDT 2003

In microsoft.public.money, Loraine wrote:

>SO...How do I get my name off of their SPAM list???
>
>I am really tired of the 10-15 virus e-mails I am
>receiving each day. This is not just ordinary junk mail,
>but e-mail that keeps my Norton very busy. Loraine

Change your email address.

Lobby congress. Yes, spammers should be incarcerated, but your
congress critters don't think so.

Loraine
Sun Oct 05 16:50:14 CDT 2003

Scott,
Thanks for the info. This helps me to understand some of
what is going on. How do I get off the list (wherever it
is being generated). I am so tired of all these e-mails.
Will I keep getting these e-mails, or will it drop off.
Loraine

>-----Original Message-----
>
>"Loraine" <loraine222@bellsouth.net> wrote in message
>news:047a01c38b7b$d8cd7e50$a401280a@phx.gbl...
>> My e-mail box has been bombarded with Virus loaded e-
mails
>> since I first used this forum a couple of months ago. I
>> suspected that someone took my e-mail address and added
it
>> to their spam list.
>>
>> So this morning, I created a new e-mail user and address
>> (loraine), posted to this forum, and an hour later
>> received the BOGUS MICROSOFT SECURITY bulletin that has
>> the SWEN virus attached at my new e-mail address.
>>
>> NO ONE else had this e-mail address. And I have 4 other
e-
>> mail accounts with my ISP that I have NOT used on this
>> forum and they have not received the Bogus e-mails. So,
>> this forum, is where this person/group is picking up e-
>> mails and adding them to the SPAM list to send out one
of
>> the latest virus threats.
>> Beware--Do not give out your e-mail address on these
>> newsgroups.
>> Loraine
>
>There is no person or group doing this. Swen.A is a worm
designed to read
>addresses from selected news servers. Anyone that gets
infected with Swen.A
>adds to the problem, particularly if a broadband
connection is available.
>Swen.A also uses the more traditional vectors of address
books and open
>fileshares.
>
>Although garden-variety spammers have harvested addresses
from Usenet for
>years, this is the first time I'm aware of that a
virus/worm/etc has done
>this.
>
>Once enough ppl were infected, the traffic generated by
infected computers
>had the effect of a distributed denial-of-service
attack. Some news admins
>had to configure their servers to use a port other than
119 for NNTP to
>block Swen.A tr