The crap posts seem to be originating from the University of Crete, suppose
we start forwarding all these crap posts back to their webmaster:



anyone know how create a bot that would automaticly forward this **** back
to its origin as soon as it hits usenet or rcm. The webmaster should be able
to track
down the idiots posting from thier network and put an end to this crap.

Best Regards
Tom.

On Mon, 13 Aug 2007 22:53:15 -0700, with neither quill nor qualm,
"azotic" quickly quoth:

The crap posts seem to be originating from the University of Crete, suppose
we start forwarding all these crap posts back to their webmaster:



anyone know how create a bot that would automaticly forward this **** back
to its origin as soon as it hits usenet or rcm. The webmaster should be able
to track
down the idiots posting from thier network and put an end to this crap.

Don't BECOME a spammer just because you have been spammed, Zot.
U of Crete has obviously been used by the spamming assholes.

--
Every day above ground is a Good Day(tm).
-----------

Larry Jaques wrote:
On Mon, 13 Aug 2007 22:53:15 -0700, with neither quill nor qualm,
"azotic" quickly quoth:


The crap posts seem to be originating from the University of Crete, suppose
we start forwarding all these crap posts back to their webmaster:



anyone know how create a bot that would automaticly forward this **** back
to its origin as soon as it hits usenet or rcm. The webmaster should be able
to track
down the idiots posting from thier network and put an end to this crap.


Don't BECOME a spammer just because you have been spammed, Zot.
U of Crete has obviously been used by the spamming assholes.
Well, once informed that they have a compromised system, it is their DUTY to
get it disconnected, disinfected and cleaned up!

Jon

According to Jon Elson :


Larry Jaques wrote:
On Mon, 13 Aug 2007 22:53:15 -0700, with neither quill nor qualm,
"azotic" quickly quoth:


The crap posts seem to be originating from the University of Crete, suppose
we start forwarding all these crap posts back to their webmaster:



anyone know how create a bot that would automaticly forward this **** back
to its origin as soon as it hits usenet or rcm. The webmaster should be able
to track
down the idiots posting from thier network and put an end to this crap.


Don't BECOME a spammer just because you have been spammed, Zot.
U of Crete has obviously been used by the spamming assholes.
Well, once informed that they have a compromised system, it is their DUTY to
get it disconnected, disinfected and cleaned up!

That appears to be just what they have done -- once they got in
on Monday and discovered what had been running. The people who
perpetrate these things like to start on late Friday night to get the
maximum time before the admin staff is back to deal with the problem.

At least the garbage has stopped here. There were only about a
hundred or so left over from last night -- which probably came via
slower paths. And I haven't seen any more after I post something (which
normally convinces my newsreader to check for new news).

Enjoy,
DoN.

--
Email: | Voice (all times): (703) 938-4564
(too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
--- Black Holes are where God is dividing by zero ---

DoN. Nichols wrote:
According to Jon Elson :
Well, once informed that they have a compromised system, it is their DUTY to
get it disconnected, disinfected and cleaned up!


That appears to be just what they have done -- once they got in
on Monday and discovered what had been running. The people who
perpetrate these things like to start on late Friday night to get the
maximum time before the admin staff is back to deal with the problem.
Our University Network administrators pass a beeper around, and
somebody is always on call. They can log in and take a machine
off the outbound firewall's OK list if it goes haywire. Any
place with at least a couple hundred machines should be required
to have similar staffing. Especially with student-owned
computers on their internal net, this is going to happen every
couple days, at least.

Jon

According to Jon Elson :
DoN. Nichols wrote:
According to Jon Elson :
Well, once informed that they have a compromised system, it is their DUTY to
get it disconnected, disinfected and cleaned up!


That appears to be just what they have done -- once they got in
on Monday and discovered what had been running. The people who
perpetrate these things like to start on late Friday night to get the
maximum time before the admin staff is back to deal with the problem.
Our University Network administrators pass a beeper around, and
somebody is always on call. They can log in and take a machine
off the outbound firewall's OK list if it goes haywire.

That would not have worked in this case. It appears that it was
a client machine (probably a Windows box) which was compromised, and
which was dumping articles into the local news server -- which took care
of transmitting them to the outside.

It would have needed someone to identify the offending machine,
and disallow it connecting to the news server -- and then flush
everything posted from it. But a lot of the stuff was already out in
the net, and would be still flowing in to everywhere else for a day or
two.

What is needed there is a limit to the number of articles per
hour that any one machine can submit to the news server.

Any
place with at least a couple hundred machines should be required
to have similar staffing. Especially with student-owned
computers on their internal net, this is going to happen every
couple days, at least.

Agreed,
DoN.

--
Email: | Voice (all times): (703) 938-4564
(too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
--- Black Holes are where God is dividing by zero ---

On Mon, 13 Aug 2007 22:53:15 -0700, azotic wrote:
The crap posts seem to be originating from the University of Crete, suppose
we start forwarding all these crap posts back to their webmaster:

Seems to me, that ****ing off the sysadmin whose help we need to stop
the problem is both counterproductive and destructive.