Clever virus

gav on 2004-03-03T04:15:51

I got this email:

	From: 	  staff@estey.com
	Subject: 	Email account utilization warning.

Dear user, the management of Estey.com mailing system wants to let  you know that,

Your e-mail account will be  disabled  because of improper  using  in next
three days, if  you are still wishing to use  it, please, resign  your
account information.

For  more  information see the attached file.

Have a good day,
     The  Estey.com team                            http://www.estey.com

Nice try :)


Going around

vsergu on 2004-03-03T05:38:31

We got some on some of our domains too.

Re:Going around

dws on 2004-03-03T16:09:10

Damn. I got one of these, apparently from one of my domains, mailed to an account on a different domain.

spamsign deciphered

merlyn on 2004-03-03T06:58:52

You can filter this one on: Exactly 19 lowercase letters in the message-ID in the local part. Not sure why they made it so simple to filter this one out.

Do not rule out incompetence.

schwern on 2004-03-03T10:44:11

These are the same guys that, don't understand, proper use of, a comma. Or how many spaces go between words.

I swear, if virus authors learned to use a grammar checker we'd all be in deep trouble.

Re:Do not rule out incompetence.

gav on 2004-03-03T13:42:04

Now that virus writing is a money making operation, how long will be it before they realize that hiring a copy editor to fix up their messages is money well spent?

Re:Do not rule out incompetence.

chromatic on 2004-03-03T17:57:08

I'd probably fall over if I received an e-mail from a working system administrator with proper grammar and spelling!

it's entertainment :)

hfb on 2004-03-03T14:51:54

keep up with the unfolding drama at f-secure

I got this variant:

mdxi on 2004-03-03T17:28:38


Dear user of Collapsar.net,

Your e-mail account has been temporary disabled because of unauthorized access.

For more information see the attached file.

Cheers,
      The Collapsar.net team http://www.collapsar.net


My favorite part is that there is no www.collapsar.net.

Re:I got this variant:

vsergu on 2004-03-05T15:51:26

It's even sillier if you're in a TLD that has a more complicated hierarchy. I've seen references to similar messages about www.wi.us and www.org.br. Apparently the virus just takes the last two segments of the host name in the e-mail address to construct the web address.

Found on alt.sysadmin.recovery

vsergu on 2004-03-05T20:02:42

Re: Important notify about your e-mail account