Spam Remedy

Fruns Dimerik · 10-21-2003, 01:29 AM

Spam Remedy (anti spam created by spammers) is still moving. The word
nagsoft says it all. Many suspect that this is a Trojan horse.

Received: from pcp01202222pcs.nrockv01.md.comcast.net (unverified
[68.50.215.101])
by flashmail.com (SurgeMail 1.5d) with ESMTP id 52564856
for multiple; Mon, 20 Oct 2003 22:53:55 -0700
Return-Path: <654zzwwl@supereva.it>
Received: from [120.11.204.104] by pcp01202222pcs.nrockv01.md.comcast.net
with ESMTP id 36397858; Wed, 22 Oct 2003 00:50:01 +0600
Message-ID: <x$62en-2-1$092747i660me@1rr.ll18a>
From: "Damon Carrier" <654zzwwl@supereva.it>
Reply-To: "Damon Carrier" <654zzwwl@supereva.it>
To: @flashmail.com
Subject: Damon Carrier, keep your mailbox free from spam and viruses.
fcamcoftbh
Date: Wed, 22 Oct 2003 00:50:01 GMT
X-Mailer: SavenHills Mail
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="DE.A_177FDD"
X-Priority: 3
X-MSMail-Priority: Normal
X-Server: High Performance Mail Server - http://surgemail.com
X-Rcpt-To: <@flashmail.com>
X-Smite-Info: SmiteCRC Oct 1 2003
X-SpamDetect-Info: This message may be spam see http://www.smitespam.com for
more information
X-SpamDetect: ****: 4.665882 SmiteCRC Partial (+0.705882,Body 2),High
tags-to-text ratio,Message has X-MSMail-Priority, but no X-MimeOLE,Message
looks like Outlook, but isn't,Contains a URL in the BIZ top-level domain
X-Smite-CRC:
A$1G92sGI$1xDPD2z$n1ePA9#r60uES$s4ezTX$12SWf01$bPg GF5$1yK4ZDc$18byN7E
Status: U
X-UIDL: 1066715636.4628_28814.flash9

--DE.A_177FDD
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

<html>

<head>
<meta http-equiv=3D"Content-Language" content=3D"en-us">
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dwindows-=
1252">
<title>S</title>
</head>

<body>

<table border=3D"1" cellspacing=3D"1" style=3D"border-collapse: collapse" =
bordercolor=3D"#D8D6DA" width=3D"560" height=3D"1">
<tr>
<td width=3D"12%" height=3D"1" align=3D"center" bgcolor=3D"#FF0000" ro=
wspan=3D"4">
S</fon=
t>
P</fon=
t>
=
A
=
M
</td>
<td width=3D"72%" height=3D"1" align=3D"center">
Kick the Spam </fon=
t>
OUT<fo=
nt face=3D"Tahoma" color=3D"#000080">
of Your Life 
with New Version  

<a href=3D"http://nagsoft.biz/remedy/?fruehauf">
SPAM REMEDY PRO 2.3!</a></fo=
nt></td>
<td width=3D"12%" height=3D"1" align=3D"center" bgcolor=3D"#000080" ro=
wspan=3D"4">
R</fon=
t>
E</fon=
t>
=
M
=
E
=
D
=
Y
</td>
</tr>
<tr>
<td width=3D"72%" height=3D"1" align=3D"center">
'Spam Remedy Pr=
o v2.3' has now
been voted the Most Intelligent Junk Email Filtering System Available =
on the
Market by the GIEC! 
        &n bsp;   &n=
bsp;       
(Global Inte=
rnet Ecommerce
Committee)=
withstand</td>
</tr>
<tr>
<td width=3D"72%" height=3D"1" align=3D"center">
&=
nbsp;+  Automatically
Blocks Spam.=
hodges =

 +  Filters POP3, Hotmail/MSN, IMAP4 and MAPI email accounts.<br=
>
 +  Easy to Use - NO SETUP REQUIRED!mace 
 +  Never blocks any messages from Clients or Friends & Fami=
ly. 
 +  Works with ALL email clients!phillip 
 +  Allows you to create your own custom filters.conspiratorial
</td>
</tr>
<tr>
<td width=3D"72%" height=3D"1" align=3D"center">
"Thanks to Spa=
m Remedy, my inbox
is HEALED!" 
- Jane Rosen=
, USA=
compress =

"No nee=
d to panic, Spam
Remedy does EXACTLY what it says!" 
- Tom Lilly,=
UK=
codebreak</td>
</tr>
</table>
<table border=3D"1" cellspacing=3D"1" style=3D"border-collapse: collapse" =
bordercolor=3D"#D8D6DA" width=3D"560">
<tr>
<td width=3D"100%">

<a href=3D"http://nagsoft.biz/remedy/?gay">
*Available for IN=
STANT DOWNLOAD
NOW* Get Y=
ours Today!</a>
</td>
</tr>
</table>
 
 

</body>

</html>
hotymbwleebzt m
xekluyz xsg

--DE.A_177FDD--

sponge · 10-21-2003, 10:44 PM

On Tue, 21 Oct 2003 08:29:31 +0200, "Fruns Dimerik"
<bosschurch@planet.nl> wrote:

>Spam Remedy (anti spam created by spammers) is still moving. The word
>nagsoft says it all. Many suspect that this is a Trojan horse.

I wouldn't be surprised. The site shows being hosted at 202.103.67.50
and their nameservers at 193.121.11.15 and 202.103.67.50, with the
primary (former) one being hosted by EU.NET and the second (latter) by
Hunan Data. With highly-mobile stuff like this, it's as important to
report the DNS providers to THEIR ISPs as well as the site itself --
in this case, anti-spam@ns.chinanet.cn.net,
hostmaster@ns.chinanet.cn.net, and to liul@hndcb.hnpta.net.cn. for the
first, and to abuse@EU.net, abuse@kpn.be, postmaster@kpn.be, and
abuse@level3.net for the other. Even better, do a traceroute to each
nameserver IP , and email the abuse departments of the connectivity
providers as well. That's especially necessary when dealing with
Chinanet.

Sponge
Sponge's Secure Solutions
www.geocities.com/yosponge
My new email: yosponge2 att yahoo dott com

Jay T. Blocksom · 10-23-2003, 04:16 PM

On Tue, 21 Oct 2003 08:29:31 +0200, in <alt.privacy.spyware>, "Fruns
Dimerik" <bosschurch@planet.nl> wrote:
>
> Spam Remedy (anti spam created by spammers) is still moving. The word
> nagsoft says it all. Many suspect that this is a Trojan horse.
>
[snip]

All well and good, but why did you then go on to post ~170 lines of the spam
-- in full-on agonizing HTML-crap form, yet?

A. This is *not* <news.admin.net-abuse.sightings>.
B. HTML is *never* appropriate here.

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Dick Hazeleger · 10-25-2003, 11:23 AM

Jay T. Blocksom wrote:

> On Tue, 21 Oct 2003 08:29:31 +0200, in <alt.privacy.spyware>,
> "Fruns Dimerik" <bosschurch@planet.nl> wrote:
> >
> > Spam Remedy (anti spam created by spammers) is still moving.
> The word > nagsoft says it all. Many suspect that this is a
> Trojan horse. >
> [snip]
>
> All well and good, but why did you then go on to post ~170 lines
> of the spam -- in full-on agonizing HTML-crap form, yet?
>
> A. This is not <news.admin.net-abuse.sightings>.
> B. HTML is never appropriate here.

Errrr. Jay... in my reader your sig is 25 lines... is THAT
appropriate here? Forgot to switch sigs after you came over from
NANAS?

Have a good week end,
Dick

Thread: Spam Remedy

Thread Tools

Display

Hybrid View

Spam Remedy

Re: Spam Remedy

Re: Spam Remedy

Re: Spam Remedy

Thread Information

Users Browsing this Thread

Posting Permissions