BEWARE PM Spam!

Post by **ericalm** » Thu Jan 14, 2010 2:11 am

A spammer has been hitting a lot of forums and sending members spammy private messages in the guise as a forum admin. It's bullpuckey.

Don't click any links from anything like this. If you get a PM that appears to be spam, please send me a message with the text and sending user's name.

Here's the message some ModernVespa members received:

Lady_Admin wrote:
Dear, [username]!

A virus alert was noticed on your computer.
We highly recommend you to check your computer and perform online virus check at our site immediately: http://[url]/[username]
----------------------------------------------------
Sincerely, Forum Administration www.modernvespa.com.

Thanks!

Syd · Post by **Syd** » Thu Jan 14, 2010 4:07 am

Ooh, sounds like Internet Security 2010. Or System Defender. :shudder:

Listen to Eric boys and girls. Unless, of course, you own a PC and see an evening spent rebuilding that PC as good practice!

michelle_7728 · Post by **michelle_7728** » Thu Jan 14, 2010 4:44 am

Bullpukey.

Cute!

KRUSTYburger · Post by **KRUSTYburger** » Thu Jan 14, 2010 5:25 am

I'm not sure who Pam is, but yes, PMS is definitely something you need to watch out for.

Syd · Post by **Syd** » Thu Jan 14, 2010 5:51 am

That's sick Krusty. (Why didn't I think of that?!?!?)

Post by **Lostmycage** » Thu Jan 14, 2010 6:18 am

KRUSTYburger wrote:I'm not sure who Pam is, but yes, PMS is definitely something you need to watch out for.

Post by **ericalm** » Sat Jan 16, 2010 7:17 am

Bump!

Member got one today from "LadyAdministrator."

irishtim · Post by **irishtim** » Sat Jan 16, 2010 2:47 pm

ericalm wrote:Bump!

Member got one today from "LadyAdministrator."

I received one today as well. I did not know it but my computer "...may have a virus" accoring to the message!

ERik3tb · Post by **ERik3tb** » Tue Jan 19, 2010 3:29 pm

I got one on Sat. I sent the info to you Eric

Post by **ericalm** » Tue Jan 19, 2010 5:40 pm

Thanks. LadyAdministrator has been banned.

The problem with these is that they're not bots. Real people are registering (requires both Captcha and responding to registration email) and sending the PMs by hand.

I'll see if I can set PM quotas or try some other means of preventing this while not interfering the normal activities.

Post by **ericalm** » Tue Jan 26, 2010 4:30 pm

Bump.

They're now using "ModernLadyX" to spam from. I banned the user.

Bah!

pocphil · Post by **pocphil** » Tue Jan 26, 2010 4:41 pm

From: ModernLadyX
To: pocphil
Posted: Tue Jan 26, 2010 9:37 am
Subject: Virus Alert!
Dear, pocphil!

A virus alert was noticed on your computer.
We highly recommend you to check your computer and perform online virus check at our site immediately:

That's the one I got PM'd 7 times today.

ModernLadyX - nice touch!

Post by **ericalm** » Wed Jan 27, 2010 1:13 am

As I've discovered from my PMs and emails today, the way to get a lot of people to return to MB after an absence is to send them several PMs.

Cheshire · Post by **Cheshire** » Wed Jan 27, 2010 6:35 am

At least they're not being very creative with their usernames. Always helpful, that.

echochamber · Post by **echochamber** » Wed Jan 27, 2010 10:22 pm

Got SPAM from MannInBlackk....

From: MannInBlackk

Subject: Please, take into account.. Quote message
Hello, friend. There are viruses' activities from your computer in last few days. Strongly recommend you to check your computer. You can find a report about your computer's security and solve every problem with it here: http://www.check-pc.net/detected/echochamber
Thank you. Forum member.

pugbuddy · Post by **pugbuddy** » Wed Jan 27, 2010 10:40 pm

Got the same.

Stormswift · Post by **Stormswift** » Wed Jan 27, 2010 11:41 pm

I already had the pleasure of Security 2010 virus. Had to re-format my entire HD. Could not get rid of it no matter what cleaner I tried. So I turned off hibernation and shutoff, copied all of the folders with vacations pictures, risked burning out the drive and the screen because laptop was on for 2 days - then formatted the whole thing. If I ever get my hand on one of the sob's who writes this stuff they will find out first hand how Chicken Kiev cutlets are made.

bigbropgo · Post by **bigbropgo** » Wed Jan 27, 2010 11:58 pm

That's what ya get for downloading porn.

Keys · Post by **Keys** » Thu Jan 28, 2010 12:21 am

OOooooh...scooter porn! Saw a sweeet Lambretta on a site just this afternoon without it's cowls on!

--Keys

potamus · Post by **potamus** » Thu Jan 28, 2010 12:54 am

I got one today from ManInBlackk but I just deleted it before I saw your link! Same story tho - "your pc has a virus, go to virus-check.com/potamus......."

rascalicious · Post by **rascalicious** » Thu Jan 28, 2010 1:43 am

same.... MannInBlackk

Stormswift · Post by **Stormswift** » Thu Jan 28, 2010 1:47 am

LOL, it was not scooter porn. Someone in my family accidentally clicked some pop up and Wham! Laptop got a "socially aquired" disease despite wearing appropriate protectiion (aka McAffe, pop up blockers of 3 kinds, etc).

bigbropgo · Post by **bigbropgo** » Thu Jan 28, 2010 1:56 am

i had this happen to a laptop. i was blown away at how powerful and nasty these things can be.

maninblack has been logged in for quite some time now. so everybody brace for spam impact.

Post by **ericalm** » Thu Jan 28, 2010 4:46 am

Sorry for the trouble, all. I banned 'im. I've tried to install some controls on PMs but apparently it's not working. I'll give it another shot.

Thanks for your patience.

iMoses · Post by **iMoses** » Thu Jan 28, 2010 3:21 pm

I feel neglected, since I haven't been spammed... NOT...

Cheshire · Post by **Cheshire** » Thu Jan 28, 2010 10:35 pm

iMoses wrote:I feel neglected, since I haven't been spammed... NOT...

You'll jinx those of us not spammed yet.

iMoses · Post by **iMoses** » Fri Jan 29, 2010 3:11 am

Sorry... my bad... LOL

I apologize in advance

Post by **ericalm** » Sat Jan 30, 2010 5:28 pm

BAH! I finally got one. Banned.

Installing another Mod to try to stop this later this weekend. Have to un-do the last one and possibly upgrade the version of PHPBB we're using which I'll do on the test server first… yadda yadda

Workin' on it, sorry!

Antinnyunparp wrote:HQ M00vies download - Avatar, Up in the Air, Sherlock Holmes, Inglourious Basterds...

Best movies download - HQ, DivX, Ipod, DVD. Fast download !!! - CLICK HERE

Avatar - DOWNLOAD HERE

Up in the Air - DOWNLOAD HERE

Legion - DOWNLOAD HERE

Inglourious Basterds - DOWNLOAD HERE

peabody99 · Post by **peabody99** » Sat Jan 30, 2010 9:40 pm

I just got this one too. I am glad this thread exists and I am bumping it, b/c I sometimes do not even look at the subject of Pm's. I deleted it w/o opening.

jmkjr72 · Post by **jmkjr72** » Sat Jan 30, 2010 11:07 pm

actauly they still are bots the wonders of spammers have managed to hack phbb based boards left and right
it seems no mater where you set the security settings at the bots seem to get thru as they have actauly hacked the phbb codes

with phbb being as populer as it is its just like windows it will attract ever hacker to its gates as they can get thru to the masses

Post by **ericalm** » Sat Jan 30, 2010 11:27 pm

Well, damn. Maybe they have gotten through our defenses.

jmkjr72 · Post by **jmkjr72** » Sun Jan 31, 2010 2:02 am

i think that there was a phbb that came out or security patch last week i know a few of the boards that i was on went down for some upgrades

i ended up using smf on my board as it was a quick install deal from go daddy

Post by **ericalm** » Sun Jan 31, 2010 2:32 am

I inherited PHP BB here. I may have to upgrade to version 3 to run the patch. Hooray.

Jackie F · Post by **Jackie F** » Thu Feb 04, 2010 2:39 am

Got one today from ladyZita. Something about finding me and link to an online credit report.

ERik3tb · Post by **ERik3tb** » Thu Feb 04, 2010 2:54 am

yea, I got that one too.

From: ladyZita
To: ERik3tb
Posted: Wed Feb 03, 2010 5:32 pm
Subject: Hi!
Haha I found you here http://onlinecreditup.com/ERik3tb it's realy you?

Post by **ericalm** » Thu Feb 04, 2010 4:19 am

Banned! Working on updates that will hopefully prevent this.

Thanks for your patience, folks.

pugbuddy · Post by **pugbuddy** » Thu Feb 04, 2010 8:43 pm

Got it too!

From: ladyZita
To: pugbuddy
Posted: Wed Feb 03, 2010 11:32 am
Subject: Hello
Haha I found you here http://onlinecreditup.com/pugbuddy it's realy you?

Post by **illnoise** » Thu Feb 04, 2010 10:31 pm

Eric, noticed that ModernVespa has a stylesheet that automatically loads for iPhone (and probably any mobile device) it totally re-designs it to make it easy to read/navigate.

WE NEED THAT!

AHORA!

that is all.

Bb.

Dave R · Post by **Dave R** » Thu Feb 04, 2010 10:54 pm

Got one today from these guys and one last week from admin. ??

VIRUS-TOTAL.NET - Domain Informationnew
Domain VIRUS-TOTAL.NET [ Traceroute RBL/DNSBL lookup ]
Registrar TODAYNIC.COM, INC.
Registrar URL http://www.NOW.CN
Whois server whois.todaynic.com
Created 31-Jan-2010
Updated 31-Jan-2010
Expires 31-Jan-2011
Time Left 360 days 1 hours 7 minutes
Status clientTransferProhibited
DNS servers NS1.EVERYDNS.NET 208.76.56.56
NS2.EVERYDNS.NET 204.152.184.150
VIRUS-TOTAL.NET - Geo Information
IP Address 91.215.170.35
Host virus-total.net
Location RU RU, Russian Federation
City Riga, 25 -
Organization Best-Hoster Group Co. Ltd
ISP Best-Hoster Group Co. Ltd
AS Number AS49693 Best-Hoster Group Co. Ltd
Latitude 54°37'39" North
Longitude 34°46'81" East
Distance 1533.42 km (952.82 miles)

potamus · Post by **potamus** » Thu Feb 04, 2010 11:22 pm

I got this one:

Inbox :: Message
From: ladyZita
To: potamus
Posted: Wed Feb 03, 2010 6:26 pm
Subject: Hey!
Haha I found you here http://onlinecreditup.com/potamus it's realy you?

Post by **ericalm** » Fri Feb 05, 2010 1:05 am

illnoise wrote:Eric, noticed that ModernVespa has a stylesheet that automatically loads for iPhone (and probably any mobile device) it totally re-designs it to make it easy to read/navigate.

WE NEED THAT!

AHORA!

that is all..

I wish I wish I wish it was just a style sheet. Jess created all sorts of custom code to get that to work. We discussed 'porting the MV code base over here. Part of the problem is that it would take us far away from any public updated version of phpBB. Anything that would require a mod or hack, then, would have to be custom or adapted from something for older versions.

As is, we may have to upgrade to get the anti-PM-spam hacks to work. For whatever reason, the spammers just stopped doing it at ModernVespa after the first time while we're getting hit every few days.

Jackie F · Post by **Jackie F** » Fri Feb 05, 2010 3:31 am

2 days in a row

From: scootertuner1000
To: Jackie F
Posted: Thu Feb 04, 2010 8:25 pm
Subject: This looks like a good argument for universal Healthcare
On the face of it this looks like a good argument for universal healthcare.

Post by **ericalm** » Fri Feb 05, 2010 5:00 am

Jackie F wrote:2 days in a row

From: scootertuner1000
To: Jackie F
Posted: Thu Feb 04, 2010 8:25 pm
Subject: This looks like a good argument for universal Healthcare
On the face of it this looks like a good argument for universal healthcare.

Um… really? Is there a link or anything like that in it?

scootertuner1000 is a legit member. It's possible he meant to post it as a reply to a post and accidentally hit the PM button.

Jackie F · Post by **Jackie F** » Fri Feb 05, 2010 8:13 am

Ok. Did not know.

pcbikedude · Post by **pcbikedude** » Mon Feb 08, 2010 1:44 am

another spammer
From: RazzorrMan
To:
Posted: Sun Feb 07, 2010 5:40 pm
Subject: Please, take into account..
Hello, friend. There are viruses' activities from your computer in last few days. Strongly recommend you to check your computer. You can find a report about your computer's security and solve every problem with it here:
Thank you. Forum member

link removed

Jackie F · Post by **Jackie F** » Mon Feb 08, 2010 2:20 am

pcbikedude wrote:another spammer
From: RazzorrMan
To:
Posted: Sun Feb 07, 2010 5:40 pm
Subject: Please, take into account..
Hello, friend. There are viruses' activities from your computer in last few days. Strongly recommend you to check your computer. You can find a report about your computer's security and solve every problem with it here:
Thank you. Forum member

link removed

ditto

Post by **ericalm** » Mon Feb 08, 2010 2:40 am

Okay, I changed the forum so that I have to approve all new members. I'll ask them to reply to an email. We'll see how that works out!

bigbropgo · Post by **bigbropgo** » Mon Feb 08, 2010 6:02 am

never heard of a forum taking it this far, but interesting.

http://forum.sascooters.co.za/index.php?topic=531.0

pugbuddy · Post by **pugbuddy** » Mon Feb 08, 2010 5:00 pm

Yep, I got this one too:

From: RazzorrMan
To: pugbuddy
Posted: Sun Feb 07, 2010 7:40 pm
Subject: Please, take into account..
Hello, friend. There are viruses' activities from your computer in last few days. Strongly recommend you to check your computer. You can find a report about your computer's security and solve every problem with it here: http://antivirus.podzone.net/hitin.php? ... d=pugbuddy
Thank you. Forum member.

Post by **ericalm** » Mon Feb 08, 2010 5:42 pm

bigbropgo wrote:never heard of a forum taking it this far, but interesting.

http://forum.sascooters.co.za/index.php?topic=531.0

I'm actually on a few forums that require an introductory post before members can access the full form and send messages, etc.

We have so many members here who read many of the posts but seldom post themselves that we'd never do this on MB. It would also turn away a lot of people who don't register but find us via search engines. That's just not the MB spirit!

Modern Buddy

BEWARE PM Spam!

BEWARE PM Spam!

Beware PM Spam!

Spam

Another one....