OT Virus link in the Newsrooms

On Tue, 10 Aug 2004 13:13:55 -0400, D Kat wrote:


All of the newsrooms are getting pornspam virus links... I am blocking those
addresses as soon as they come in. What I became curious about is - are the
addresses that I'm blocking legitimate posters that were idiots and opened
the virus link or are they made up addresses that are safe to block?

You should probably read the whole thing, but a small
snippet from http://www.faqs.org/faqs/usenet/what-is/part1/

(Note that the correct term is "newsgroups"; they are not called
areas, bases, boards, bboards, conferences, round tables, SIGs,
echoes, rooms or usergroups! Nor, as noted above, are they part of
the Internet, though they may reach your site over it. Furthermore,
the people who run the news systems are called news administrators,
not sysops. If you want to be understood, be accurate.)


To address your specific question, the addresses are
almost all fake, and used only once or twice. "Block"
them if you want, but it does nothing to prevent the
same spammers from getting through your "block" tomorrow
using a different address.

You're better off to create filters that act on
content or "class" of message. Can OE do this?
Find out what its filtering capabilities are, and
apply them to the body of the message (if possible)
in addition to the headers. If OE is incapable of
intelligent filtering, consider a newsreader that
can do what you want.

A large percentage of usenet spam is multicast to
many groups simultaneously. Filter out all articles
crossposted to more than 4 groups, and you cut out 90%
of the garbage. Filter out articles containing .pif,
..scr, .zip, and .exe attachments and/or links, and you
get 90% of the remainder (or any class of binary if
you never frequent alt.binaries...).

Further, most .biz and .info domains are hosted by
spammers. You can pretty safely filter out any
article containing links to those.

Voila. 99+% of the garbage is never seen.

If you don't want to get into filtering yourself,
there are a number of news servers where the filters
are already in place. Seek out one of those, and you
never have to see another make-money-fast "non-
pyramid" scam, or link to Marge and Homer having sex,
Osama hanged message.

One other possibility: If your system administrator
is open to filtering, you may be able to get that done
on your present server. e-mail behzad-AT-noc.stonybrook.edu
to find out if he's willing.