Poco support cracked? [Mod: Resolved - spammer on board]

[ente]

Hello, a few minutes ago, I got the following mail

Code: Select all

From <> Sun, 03 Jan 2010 15:29:01 -0600
From:      <>
To:        <>
Return-Path: <>
X-Original-To: <>
Delivered-To: <>
Received: from mx-03.datacomm.ch (mx-03.datacomm.ch [212.40.2.36])
        by pop-pri-05.datacomm.ch (VTX Datacomm AG) with ESMTP id 9257ADC179
        for <gperll@datacomm.ch>; Sun,  3 Jan 2010 21:28:55 +0100 (CET)
Received: from mx-03.datacomm.ch (localhost.localdomain [127.0.0.1])
        by mx-03.datacomm.ch (VTX Datacomm AG) with SMTP id 74A357012D
        for <>; Sun,  3 Jan 2010 21:28:55 +0100 (CET)
Received: from srv01.pocosystems.com (srv01.pocosystems.com [67.15.196.12])
        by mx-03.datacomm.ch (VTX Datacomm AG) with ESMTP id E9A6270121
        for <>; Sun,  3 Jan 2010 21:28:54 +0100 (CET)
X-ClientAddr: 127.0.0.1
Received: from srv01.pocosystems.com (localhost.localdomain [127.0.0.1])
        by srv01.pocosystems.com (8.12.11.20060308/8.12.11) with ESMTP id o03LT1Zc007807
        for <>; Sun, 3 Jan 2010 15:29:01 -0600
Received: (from apache@localhost)
        by srv01.pocosystems.com (8.12.11.20060308/8.12.11/Submit) id o03LT14m007805;
        Sun, 3 Jan 2010 15:29:01 -0600
Reply-to: <>
Message-ID: <>
Date: Sun, 03 Jan 2010 15:29:01 -0600
X-MSMail-Priority: Normal
X-Mailer: PHP
X-MimeOLE: Produced By phpBB2
X-yoursite-MailScanner-Information: Please contact the ISP for more information
X-yoursite-MailScanner: Found to be clean
X-MailScanner-From: <>
X-Antivirus: avast! (VPS 100103-0, 03.01.2010), Inbound message
X-Antivirus-Status: Clean
Delivery-Date: Sun, 3 Jan 2010 21:30:22
Status: U
X-Poco-Score-Detail: -100 [%BAYES%=P=0;T=90;BIAS=+20] (%bayes% P=0;T=90;Bias=+20)
X-Poco-Score-Detail: -100 [FROM=%EXCEPTSENDERS%] (From %exceptsenders%)
X-Poco-Score-Detail: -4 [TO=%ADDRESSBOOKS%]OR[CC=%ADDRESSBOOKS%] (To %addressbooks%, or Cc %addressbooks%)
X-Poco-Score-Detail: +2 [FROM=%ADDRESSBOOKS%] (From %addressbooks%)
X-Poco-Scored: -202
Subject: New Private Message has arrived
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
X-Poco-UID: 01166643
X-Poco-Status: RW
X-Account: Götz Perll

Headers

Forward

Reply

Bounce

Reply All

Print
Hello ente,

You have received a new private message to your account on "Poco Forums" and you have requested that you be notified on this event. You can view your new message by clicking on the following link:

http://pocosystems.com/forum/privmsg.php?folder=inbox

Remember that you can always choose not to be notified of new messages by changing the appropriate setting in your profile.

--
Thanks,

Poco Forums Management

When I went to see how somebody is trying to help me, I got reccomended - by somebody living in Mozambique who's occupation is "accounting, finance", and interest lies in "dancing" - to make use of online pharmacies....

How did he get hold of pocosystems support forum, and knows about the wording used in the pocoforum,
asks somehow irritated
ente

...who is at the same time sending all the little helpers out there his thanks for their work and best wishes for 2010

[Eric]

How did he get hold of pocosystems support forum, and knows about the wording used in the pocoforum,
asks somehow irritated

Don't know anything about it

However it's possible that spammer registered here, since I've been banning a lot of them lately.
As such he PM's you with his spam, so the message you receive from this board is real.

...who is at the same time sending all the little helpers out there his thanks for their work and best wishes for 2010

Who is

Remember that spammers change their ways.
Previously they posted their spam on this board, but lately they register, join the discussion of a thread and in their signature you'll find the link to their website.

Quite difficult to know if it's indeed a spammer or a regular forum member

BTW I removed the email adresses from your post to prevent harvesting and moved it from Junk filtering.

[chrisretusn]

This sort of thing happens. It has nothing to do with Poco Support. That message is a feature of the forum software. It is sent out when you receive a PM from a another forum member. FYI: This can be turned off by setting Notify on new Private Message: to Off in Profile Preferences.

The individual who sent that was a spammer who most likely manually registered for the forum for the purpose of adding spam post or sending spam PM's like the one you got. It is quite possible the other members also received the same spam.

This sort of thing is impossible to stop, the forum administrators have no idea if a newly register member is a spammer or not; until the spammer actually post or another member such as your self notifies the administrators, moderators of receiving spam PM's.

The best course of action is to send a PM to an administrator that you received a PM spam. When you do notify the administrators be sure to include the username of the spammer. Even better quote the post, remove the senders name from Username and replace it with an administrators name. Then send it. This will give the administrator the username plus a look at the PM.

It is also important to never click a link in a spam message. Not that it will cause any harm to your computer, but what it will do is tell the spammer that his spam was such successful because the server that link goes to will know it came from pocosystems.com.

You did not mention the username in your post. I may help Eric determine if he has indeed banned the user. Those pesky PM spammer are the hardest to get because users must tell someone about them. Post are easy to spot and the administrators, moderators here do a outstanding job of catching them. Every now and then I do notice a new spam post, but it is gone at next login.

[ente]

How did he get hold of pocosystems support forum, and knows about the wording used in the pocoforum,
asks somehow irritated

Don't know anything about it

However it's possible that spammer registered here, since I've been banning a lot of them lately.
As such he PM's you with his spam, so the message you receive from this board is real.

...who is at the same time sending all the little helpers out there his thanks for their work and best wishes for 2010

Who is

Who is you, MarkB, Tomas and all the others helping me and others alive when using PocoMail.
Thanks again,
Ente

[Eric]

Who is you, MarkB, Tomas and all the others helping me and others alive when using PocoMail.

Misunderstood, sorry.

If you pass on the name of the spammer, I can check it if indeed he was banned from this forum.
Like chrisretusn said, it's not easy to find out who's a spammer and who's not.

Lately I banned a spammer who re-registered 18 times and as such he posted spam about V**gra.

You see, they are quite determined to spam this board and others.

[luxor]

On some forums I am a member of you can't send PM's until you have posted a certain amount of times. Is that possible with the forum software used here?

Might be something to think about.

[Eric]

On some forums I am a member of you can't send PM's until you have posted a certain amount of times. Is that possible with the forum software used here?

Don't know if it's possible or not. Slaven will surely know, since he's the admin.
It could help, although there are some disadvantages too.

It's a problem with a lot of boards and I don't know how we can possibly ban all those spammers without user intervention.

[ente]

The best course of action is to send a PM to an administrator that you received a PM spam. When you do notify the administrators be sure to include the username of the spammer. Even better quote the post, remove the senders name from Username and replace it with an administrators name. Then send it. This will give the administrator the username plus a look at the PM.

Thanks for your help. That what I tried to do.
When I went looking for the mail anounced, I came to the index only, not to a specific mail.

So I send my answer to the address this "support" came from, which was: support _ pocosystems.com.

A few seconds later I got a mail from no-reply _ pocosystems.com, letting me know, that my mail was not received and that I should go via the help request form. Since that didn't convince me, I decided to create a new topic in the help and how to forum and placed there the mail exactly as I had received with the full header. That means, I sent the full mail with all information I had received, I did not delete the user name.
Cordially,
Ente

~ Disabled live email adresses ... Eric ~

[Eric]

A few seconds later I got a mail from <>, letting me know, that my mail was not received and that I should go via the help request form.

Why not submit it to the Helpdesk
Or you could simply send it to me through PM, so I could investigate it further.

In any case I still didn't get the name of the spammer, so I'm unable to check which one it was.

[rrx3]

I have received this in my Pocomail pms:
From: Lady_Admin
To: rrx3
Posted: Wed Jan 13, 2010 8:35 am
Subject: Important message from the forum administration
Dear, rrx3!

A virus alert was noticed on your computer.
We highly recommend you to check your computer and perform online virus check at our site immediately: hxxp://antivirus.effectmeds.com/rrx3
----------------------------------------------------
Sincerely, Forum Administration pocosystems.com.

Is this a fake?

~ Deactived link to rogue webpage ... Eric ~

[carladave]

I got the same thing. It most definitely must be fake.

Dave

[luxor]

I didn't receive it but I would say that it definitely IS a fake.

[Eric]

I have received this in my Pocomail pms:
From: Lady_Admin

This user has been deleted.
Damn spammers.
Txs for reporting it.

[Tomas]

Thanks a lot Eric !

Oh...Lady_Admin, I received spam with that nick on on some other boards recently...

PM's can be globally disabled only.
Since this is phpBB there are probably number of modules that allow extended control over that functionality, but adding other modules to the base install increases the probability of the board being hacked, also not sure how fair it would be to block new members from a possibility to send a PM.

As Eric suggested, best way to keep annoyances to minimum is edit your settings here: don't show email address, don't notify on new private message.

[jbuk]

I too have now received this virus alert private message from user LadyXAdmin.
Its such an obvious hoax.