The view of the experts is requested - please!

[~BD~]

Hi

In this post
http://groups.google.com/group/alt.p...57a243cf?hl=en

It is said ......

"It is an executable. That is what shows up for me and not a Data file.
It shows as an Unknown file type 2.06 mb and as soon as I try and
download the file all kinds of alarms go of on this server.
Did you execute the file? If anybody did let me know what you found
after running your malware tools.

This is the link which is the cause of controversy (now obfuscated)

hxxp://www.google.com/url?sa=D&q=http://xa.yimg.com/kq/groups/14452350/478679383/name/Word_Riddle%252Ewmv&usg=AFQjCNGMB_0iIHI_Ww-vYwNenCWXH90LiA

It came from a Yahoo Groups 'joke' group and what *I* see is simply a
'video' explaining an interesting word/riddle. (a 'wmv')

I'm not so sure that any file was actually downloaded to my computer but
would be interested to take advice on this. I'm not certain how to check
(but I did *not* have to 'approve' anything!)

--
Dave - On iMac OS X 10.6.4 with Flip4Mac Windows Media Components for
QuickTime 2.3.4.1

[Mike Easter]

Posted to a.p.s only

~BD~ wrote:
Newsgroups: alt.privacy.spyware, Alt.politics.scorched-earth

This message of yours is a stupid and inappropriate crosspost. An
excellent filter would be one which filters out any message which you
ever crosspost.

> http://groups.google.com/group/alt.p...57a243cf?hl=en

If one reads the actual thread of the single message you have linked...

GG link to recent 9 message thread in scorched-earth
http://peek.snipr.com/160j8o

.... one will see that the topic has been discussed sufficiently in that
group.

The filename in question is Word_Riddle.wmv

Here is a wiki discussion of that file type
http://en.wikipedia.org/wiki/.wmv

I recommend that you develop your own filter or more appropriate
philosophy for dealing with your PF interactions and stop bothering
other people with questions related to your interactions with him.

--
Mike Easter

[StevieO]

"Mike Easter" <MikeE@ster.invalid> wrote in message
news:8g3utqF6e8U1@mid.individual.net...
Posted to a.p.s only

~BD~ wrote:
Newsgroups: alt.privacy.spyware, Alt.politics.scorched-earth

This message of yours is a stupid and inappropriate crosspost. An
excellent filter would be one which filters out any message which you
ever crosspost.

> http://groups.google.com/group/alt.p...57a243cf?hl=en

If one reads the actual thread of the single message you have linked...

GG link to recent 9 message thread in scorched-earth
http://peek.snipr.com/160j8o

.... one will see that the topic has been discussed sufficiently in that
group.

The filename in question is Word_Riddle.wmv

Here is a wiki discussion of that file type
http://en.wikipedia.org/wiki/.wmv

I recommend that you develop your own filter or more appropriate
philosophy for dealing with your PF interactions and stop bothering
other people with questions related to your interactions with him.

--
Mike Easter

[Boyd]

"Mike Easter" <MikeE@ster.invalid> wrote in message
news:8g3utqF6e8U1@mid.individual.net...
> Posted to a.p.s only
>
> ~BD~ wrote:
> Newsgroups: alt.privacy.spyware, Alt.politics.scorched-earth
>
> This message of yours is a stupid and inappropriate crosspost. An
> excellent filter would be one which filters out any message which you
> ever crosspost.
>
>> http://groups.google.com/group/alt.p...57a243cf?hl=en
>
> If one reads the actual thread of the single message you have
> linked...
>
> GG link to recent 9 message thread in scorched-earth
> http://peek.snipr.com/160j8o
>
> ... one will see that the topic has been discussed sufficiently in
> that group.
>
> The filename in question is Word_Riddle.wmv
>
> Here is a wiki discussion of that file type
> http://en.wikipedia.org/wiki/.wmv
>
> I recommend that you develop your own filter or more appropriate
> philosophy for dealing with your PF interactions and stop bothering
> other people with questions related to your interactions with him.


BD said.............

<q/p>
I'm not so sure that any file was actually downloaded to my computer but
would be interested to take advice on this. I'm not certain how to check
(but I did *not* have to 'approve' anything!)
<q>

Mike Easter's response does not address this specific issue.

Does clicking on the link
hxxp://xa.yimg.com/kq/groups/14452350/478679383/name/Word_Riddle%2Ewmv

*actually* result in anything being downloaded onto a user's computer?

[FromTheRafters]

"Boyd" <Boyd@nospam.invalid> wrote in message
news:i7kjo1$958$1@news.eternal-september.org...

[...]

> Does clicking on the link
> hxxp://xa.yimg.com/kq/groups/14452350/478679383/name/Word_Riddle%2Ewmv
>
> *actually* result in anything being downloaded onto a user's computer?

Of course it does.

[Mike Easter]

Boyd wrote:
> "Mike Easter"

>> Posted to a.p.s only

Why are you crossposting a reply to my message to another unrelated group.

a.p.s-e group deleted from my reply.

> BD said.............
>
> <q/p>
> I'm not so sure that any file was actually downloaded to my computer but
> would be interested to take advice on this. I'm not certain how to check
> (but I did *not* have to 'approve' anything!)
> <q>
>
> Mike Easter's response does not address this specific issue.
>
> Does clicking on the link
> hxxp://xa.yimg.com/kq/groups/14452350/478679383/name/Word_Riddle%2Ewmv
>
> *actually* result in anything being downloaded onto a user's computer?

The link is to a .wmv file in a webserver path.

When the browser accesses the webserver and requests the .wmv file, the
webserver serves it to the browser which uses some app to display the
multimedia content, therefore 'something' is 'downloaded' to the user's
computer.

Your question indicates a lack of insight.

What specific issue are /you/ trying to learn about? The apparent
purpose of BD's post was to carry on an argument/disagreement with PF.
What is /your/ purpose and why do you crosspost your message in such a
disparate way?

alt.privacy.spyware discussions do not belong in - should not be
crossposted to - alt.politics.scorched-earth.

The "Boyd" - Boyd@nospam.invalid - persona has no posting history. I
suspect it is a sockpuppet for some other persona around here.

Injection-Info: mx03.eternal-september.org;
posting-host="zr8MmIqNqEHmXYG8DnBPqw";
logging-data="9384"; mail-complaints-to="abuse@eternal-september.org";
posting-account="U2FsdGVkX18SGHJbXmF/lE9MIqStlz7v"
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931


--
Mike Easter

[Peter Foldes]

>Why are you crossposting a reply to my message to another unrelated group.

>a.p.s-e group deleted from my reply.


Mike

Because it is BD using another posting name which he has used before.

--
Peter
Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.
This posting is provided "AS IS" with no warranties, and confers no rights.
http://www.microsoft.com/protect

[Mike Easter]

Peter Foldes wrote:
>> Why are you crossposting a reply to my message to another unrelated
>> group.
>
>> a.p.s-e group deleted from my reply.
>
>
> Mike
>
> Because it is BD using another posting name which he has used before.

Yes, I believe it could be BD.

He has access to a

X-Newsreader: Microsoft Outlook Express 6.00.2900.5931

and an eternal-september account, like the Boyd persona post shows.


--
Mike Easter

[Boyd]

"Mike Easter" <MikeE@ster.invalid> wrote in message
news:8g6tg7Fl7tU1@mid.individual.net...
> Boyd wrote:
>> "Mike Easter"
>
>>> Posted to a.p.s only
>
> Why are you crossposting a reply to my message to another unrelated
> group.

The OP - for whatever reason - elected to cross-post to S-E. You, Sir,
have no authority to delete a group from your response. There may be
people in the S-E group who wish to follow the thread.

> a.p.s-e group deleted from my reply.

Added back!

>> BD said.............
>>
>> <q/p>
>> I'm not so sure that any file was actually downloaded to my computer
>> but
>> would be interested to take advice on this. I'm not certain how to
>> check
>> (but I did *not* have to 'approve' anything!)
>> <q>
>>
>> Mike Easter's response does not address this specific issue.
>>
>> Does clicking on the link
>> hxxp://xa.yimg.com/kq/groups/14452350/478679383/name/Word_Riddle%2Ewmv
>>
>> *actually* result in anything being downloaded onto a user's
>> computer?
>
> The link is to a .wmv file in a webserver path.
>
> When the browser accesses the webserver and requests the .wmv file,
> the webserver serves it to the browser which uses some app to display
> the multimedia content, therefore 'something' is 'downloaded' to the
> user's computer.
>
> Your question indicates a lack of insight.

What should I do - apologise? To whom?

> What specific issue are /you/ trying to learn about? The apparent
> purpose of BD's post was to carry on an argument/disagreement with PF.
> What is /your/ purpose and why do you crosspost your message in such a
> disparate way?
>
> alt.privacy.spyware discussions do not belong in - should not be
> crossposted to - alt.politics.scorched-earth.

PF intimated that 'malware' had been diseminated by ~BD~ with the
intention of infecting the computers of group members.

Perhaps he (BD) was asking the experts in the 'spyware' group if any
malware *had* been passed down to those who clicked on the link posted.
I concede that I should, perhaps, have said ..........

Does clicking on the link
hxxp://xa.yimg.com/kq/groups/14452350/478679383/name/Word_Riddle%2Ewmv

*actually* result in any MALWARE being downloaded onto a user's
computer?

*Was* any malware discovered to be associated with that link from Yahoo
Groups?

> The "Boyd" - Boyd@nospam.invalid - persona has no posting history. I
> suspect it is a sockpuppet for some other persona around here.
>
> Injection-Info: mx03.eternal-september.org;
> posting-host="zr8MmIqNqEHmXYG8DnBPqw";
> logging-data="9384"; mail-complaints-to="abuse@eternal-september.org";
> posting-account="U2FsdGVkX18SGHJbXmF/lE9MIqStlz7v"
> X-Newsreader: Microsoft Outlook Express 6.00.2900.5931

Suspicion is one thing. Proof is another.

PF makes a positive - and WRONG - statement here:-
http://groups.google.co.uk/group/alt...6ee26e58?hl=en

Does Foldes *always* lie?

..

[Peter Foldes]

David

Crossposting removed

Just to advice everyone it is you posting from your so invented son in laws
residence

Slowly you are showing you colors which I always maintain about you. You are a Troll
and one decimating crossposter ,thief,liar and a forger.

BTW: There is no reason for you to crosspost and nobody in their right mind takes
notice of your drivel aside from your clone (Jenn)

--
Peter
Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.
This posting is provided "AS IS" with no warranties, and confers no rights.
http://www.microsoft.com/protect


"Boyd" <Boyd@nospam.invalid> wrote in message
news:i7nsfo$pmn$1@news.eternal-september.org...
> "Mike Easter" <MikeE@ster.invalid> wrote in message
> news:8g6tg7Fl7tU1@mid.individual.net...
>> Boyd wrote:
>>> "Mike Easter"
>>
>>>> Posted to a.p.s only
>>
>> Why are you crossposting a reply to my message to another unrelated group.
>
> The OP - for whatever reason - elected to cross-post to S-E. You, Sir, have no
> authority to delete a group from your response. There may be people in the S-E
> group who wish to follow the thread.
>
>> a.p.s-e group deleted from my reply.
>
> Added back!
>
>>> BD said.............
>>>
>>> <q/p>
>>> I'm not so sure that any file was actually downloaded to my computer but
>>> would be interested to take advice on this. I'm not certain how to check
>>> (but I did *not* have to 'approve' anything!)
>>> <q>
>>>
>>> Mike Easter's response does not address this specific issue.
>>>
>>> Does clicking on the link
>>> hxxp://xa.yimg.com/kq/groups/14452350/478679383/name/Word_Riddle%2Ewmv
>>>
>>> *actually* result in anything being downloaded onto a user's computer?
>>
>> The link is to a .wmv file in a webserver path.
>>
>> When the browser accesses the webserver and requests the .wmv file, the webserver
>> serves it to the browser which uses some app to display the multimedia content,
>> therefore 'something' is 'downloaded' to the user's computer.
>>
>> Your question indicates a lack of insight.
>
> What should I do - apologise? To whom?
>
>> What specific issue are /you/ trying to learn about? The apparent purpose of BD's
>> post was to carry on an argument/disagreement with PF. What is /your/ purpose and
>> why do you crosspost your message in such a disparate way?
>>
>> alt.privacy.spyware discussions do not belong in - should not be crossposted to -
>> alt.politics.scorched-earth.
>
> PF intimated that 'malware' had been diseminated by ~BD~ with the intention of
> infecting the computers of group members.
>
> Perhaps he (BD) was asking the experts in the 'spyware' group if any malware *had*
> been passed down to those who clicked on the link posted. I concede that I should,
> perhaps, have said ..........
>
> Does clicking on the link
> hxxp://xa.yimg.com/kq/groups/14452350/478679383/name/Word_Riddle%2Ewmv
>
> *actually* result in any MALWARE being downloaded onto a user's computer?
>
> *Was* any malware discovered to be associated with that link from Yahoo Groups?
>
>> The "Boyd" - Boyd@nospam.invalid - persona has no posting history. I suspect it
>> is a sockpuppet for some other persona around here.
>>
>> Injection-Info: mx03.eternal-september.org;
>> posting-host="zr8MmIqNqEHmXYG8DnBPqw";
>> logging-data="9384"; mail-complaints-to="abuse@eternal-september.org";
>> posting-account="U2FsdGVkX18SGHJbXmF/lE9MIqStlz7v"
>> X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
>
> Suspicion is one thing. Proof is another.
>
> PF makes a positive - and WRONG - statement here:-
> http://groups.google.co.uk/group/alt...6ee26e58?hl=en
>
> Does Foldes *always* lie?
>
> .
>
>