Someone is using the account of "Michael Tracy" to send spam, the usual "We've detected a virus on your computer (yeah, right) and you need to click this link immediately and have it scanned, else we'll delete your account."

Aside from the (yawn) obviousness and old age of this ploy, only the Admin would be sending such a message, or have the slightest chance of knowing of same, perhaps by scanning an attachment that was uploaded. No other way.

Anyone else getting these?

Someone is using the account of "Michael Tracy" to send spam, the usual "We've detected a virus on your computer (yeah, right) and you need to click this link immediately and have it scanned, else we'll delete your account."

Aside from the (yawn) obviousness and old age of this ploy, only the Admin would be sending such a message, or have the slightest chance of knowing of same, perhaps by scanning an attachment that was uploaded. No other way.

Anyone else getting these?


a few of them went out... there's limits on new members for the number of PMs they can send, so I doubt too many got sent.  It was really amateurish looking too.

Yeah, I got one.  Do people still fall for that stuff?

Yeah, I got one.  Do people still fall for that stuff?


from what I can tell it's usually people who aren't used to computers who tend to open that kind of thing... like my parents.

that explains what he was up to.  When I was looking at the Who's Online bit this afternoon he was always sending messages.  Which I thought was odd for someone with no posting history

I think he got banned within 15 minutes of when I saw mine.

I got one, as well!

a few of them went out... there's limits on new members for the number of PMs they can send, so I doubt too many got sent.  It was really amateurish looking too.
You mean like, where it was signed "Forum Administration", when you've signed as "ChuckyG" almost 8,000 times?  :P
Do people still fall for that stuff
]
from what I can tell it's usually people who aren't used to computers who tend to open that kind of thing... like my parents
They're the ones who need the totally-free-ware NoScript the most. You can whitelist sites like amiright and inthe00s, but any executable content from every non-whitelisted site is blocked by default. Anyone who bit would probably be sent to a link in China, Taiwan, Ukaraine, or maybe here in the US -- but it wouldn't be here at 00s, because you don't allow users to upload executable content (the recent vulns in Windows Graphics Rendering notwithstanding). So even if your parents bite, NoScript would prevent the malicious code from running. It's saved a zillion people.

The learning curve of how to allow trusted sites can be very short, especially if you (or someone tech-knowledgeable) helps. Otherwise, there's an FAQ, and a Quick Start Guide For Beginners that should help. 

Since the product is absolutely, totally free, no strings attached (donations accepted, but no nag screens), I hope this isn't regarded as spamming something that could cut malicious exploits dramatically if used more widely. Else, just delete this post.

Oh, and the fact that the linked Quick Start Guide was written by someone named "Tom T." is strictly coincidental.  8)

p. s. Where is the "Cancel" button for composing messages? Can't see it....

that explains what he was up to.  When I was looking at the Who's Online bit this afternoon he was always sending messages.   Which I thought was odd for someone with no posting history

I saw that too. I also clicked on his profile and saw for "Website" that it was a link back to his own profile (rather recursive) with some advertising message in the text of the link ("Take measures immediately!"). So I suspected it was some spammer/scammer...

I saw that too. I also clicked on his profile and saw for "Website" that it was a link back to his own profile (rather recursive) with some advertising message in the text of the link. So I suspected it was some spammer/scammer...

That's a very common spamming technique. It's not that so many will look at your profile, it's that you get your link or product raised in the search engine rankings by the web crawlers.
However, usually such people stay very quiet, or make one or two innocuous posts, to avoid detection. Calling attention to himself by the PMs defeats the search-engine-ranking motive. Maybe the link actually was malicious. Is his profile still there, or can you email or PM me whatever link was in it? I can check it out safely (see above) and see what the ultimate goal was.

FWIW, the forum mentioned above has a bot that deletes new registered users if they don't post anything within X number of days, on the grounds that "If you weren't going to post, why did you register? ... Must be a spammer."
That's probably more valid there, at a tech-support forum, then at a more social site like this one, where peeps just want to join the crowd until they have something to post. Might not be a bad *flag*, though -- would only take a few seconds to check out any profiles that said bot would report. 

That's a very common spamming technique. It's not that so many will look at your profile, it's that you get your link or product raised in the search engine rankings by the web crawlers.
However, usually such people stay very quiet, or make one or two innocuous posts, to avoid detection. Calling attention to himself by the PMs defeats the search-engine-ranking motive. Maybe the link actually was malicious. Is his profile still there, or can you email or PM me whatever link was in it? I can check it out safely (see above) and see what the ultimate goal was.

FWIW, the forum mentioned above has a bot that deletes new registered users if they don't post anything within X number of days, on the grounds that "If you weren't going to post, why did you register? ... Must be a spammer."
That's probably more valid there, at a tech-support forum, then at a more social site like this one, where peeps just want to join the crowd until they have something to post. Might not be a bad *flag*, though -- would only take a few seconds to check out any profiles that said bot would report. 

Yes, his account is still there. I'll PM you with the link to his profile...

I'm hurt that once again I didn't get the spam

Preliminary findings: His email address is a link-spam of that organization, which, IIRC, is devoted to sneaky ways to raise your search-engine standings.
The actual link to the virus scanner: I searched on Scroogle, and there are tons of threads, with the headline, "750,000 computers have been infected with this virus!" But when you click them, there is nothing there -- meaning that he's been posting that at all kinds of forums (The Peugot Owners' Club? I mean, *really*!  :P ) and the Admins have already deleted them.

As for the two sites in question: They're both blocked by some of my security tools - in this case, the HOSTS file - so I can't even connect there. But I'll unblock them temporarily, while wearing several other Internet condoms ("safe hex"), and post back a little later.

DO NOT CLICK THE LINK IN THE PM!!!!!!!  The one about virus-scanning. It's a sure infection/exploit/hack -- whatever. It's obviously evil.

More later.

@ Karen: Perhaps he had *just* enough brains not to spam the site admin and editors?

I'm hurt that once again I didn't get the spam


If I hadn't deleted it I would forward it to you...would that make you feel better? ;)

I got one too, which I reported. I guess that means he thinks I'm a tech noob? Oy, what a bad judgment call.  ;D

If I hadn't deleted it I would forward it to you...would that make you feel better? ;)


It would have

I got one too, which I reported. I guess that means he thinks I'm a tech noob? Oy, what a bad judgment call.  ;D

Tim Mayfield, ditto here. Here's the scoop:

******DO NOT VISIT ANY LINK IN THE SPAM MESSAGE, OR THE ONES TRACED BELOW*****

"Michael Tracy"s email address trace (Trace on Tracy .... oh, TT! ;)

dadmin.webhop.biz  IP = 212.117.165.179
212.117.165.179 is from Luxembourg(LU) in region Western Europe

ISP:
root eSolutions
address #1:: 35, rue John F. Kennedy
address #2: 7327 Steinsel address: Luxembourg

*This is the ISP, not the spammer! If Admin or Editors wish to take action against "Michael Tracy" (probably long since gone),
"Report abuse to abuse@as5577.net"

The link to the "virus scanner":
http://SPAMMERSITE  IP = 59.53.91.124

BINGO!!!!!!!!

59.53.91.124 is from China(CN)

YESSSSSSS!!!! As predicted above (blows lightly on fingernails)

(caps are theirs, not mine. I don't shout, much.)
netname: CHINANET-JX
descr: CHINANET Jiangxi province network
descr: China Telecom
role: JXDCB NET address: DATA COMMUNICATION BUREAY
address: NO.39,YANJIANG NORTH ROAD,NANCHANG,JIANGXI
country: CN
phone: +86 791 6730586
fax-no: +86 791 6707755
e-mail: hostmaster@public1.nc.jx.cn
trouble: send spam reports to hostmaster@public1.nc.jx.cn
and abuse reports to hostmaster@public1.nc.jx.cn

I'm sure that the Chinese authorities will be very cooperative  :P
They're probably behind it in the first place.

A good safety reminder for all -- and a reminder that we're not nearly so "anonymous" on the Internet as we might think. Act accordingly.