• Home
  • Help
  • Search
  • Login
  • Register
Pages: [1]
Author Topic: SPAM/VIRUS ALERT !!! Ignore "I am interested in your nick-name" PM  (Read 1858 times)
edmc
Newbie
*

Karma: 1
Posts: 21


View Profile
« on: March 18, 2010, 01:58:37 PM »

Received the following PM from "endisorc" (listed as a "Newbie")
Code:
  I am interested in your nick-name
  Greetings companion edmc !
  We are interested in your name
  We study non-standard nicknames
  Look about your names http://mimosa.org.ua/edmc

Following the link immediately attempts to download something (I discarded it immediately so I do not know what crap was attempting to infect my PC).

Suggest you do the same  Tongue
Logged

birdman
Sr. Member
****

Karma: 4
Posts: 440


View Profile WWW
« Reply #1 on: March 18, 2010, 06:04:28 PM »

It downloads a file called bestnicknames.exe.   A windows binary, which contains this interesting text:
Quote
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
   <assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="UAC" type="win32"/>
      <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
      <security>
         <requestedPrivileges>
            <requestedExecutionLevel level="highestAvailable"/>
         </requestedPrivileges>
      </security>
   </trustInfo>
</assembly>

If it's just a friendly user prorgam, why would it need the "highestAvailable" execution level?
Logged

Rabeeh Khoury
Administrator
Full Member
*****

Karma: 5
Posts: 218


View Profile
« Reply #2 on: March 21, 2010, 01:46:45 AM »

I wiped his account.

Thanks for the report,
Rabeeh
Logged

mookiedog
Newbie
*

Karma: 5
Posts: 25


View Profile
« Reply #3 on: March 29, 2010, 09:09:15 PM »

I got a variant on that email today from user billiink on this forum.  It is a link to the same site: http://mimosa.org.ua/

Maybe you could nuke that account too.  Thanks!

The msg:

You have just been sent a personal message by Billiink on The Plug Computer Forum.

IMPORTANT: Remember, this is just a notification. Please do not reply to this email.

The message they sent you was:

Greetings mookiedog !
Has found a lot of the interesting information and photos of participants of a forum Smiley
About you too has found http://mimosa.org.ua/mookiedog

Reply to this Personal Message here: http://plugcomputer.org/plugforum/index.php?action=pm;sa=send;f=inbox;pmsg=648;quote;u=2565



Logged

Rabeeh Khoury
Administrator
Full Member
*****

Karma: 5
Posts: 218


View Profile
« Reply #4 on: April 06, 2010, 03:28:05 AM »

I can't find username 'Billiink'. Are you sure you got it right?

I hold my canons for now.
Logged

rooster
Administrator
Sr. Member
*****

Karma: 8
Posts: 311


View Profile
« Reply #5 on: April 06, 2010, 03:29:25 AM »

I removed this user.
Logged

Pages: [1]
Print
Jump to: