just skip to point 15: use linux

Story: 16 Ways To Beat Cryptolocker and RansomwareTotal Replies: 11
Author Content
mbaehrlxer

Dec 23, 2013
8:02 PM EDT
this article is barely linux related by suggesting at the very end that linux users have nothing to worry about.

now, could we maybe add a windows category to lxer so that articles like these that are not so interesting for those who do not use windows can be marked accordingly?

greetings, eMBee.
BernardSwiss

Dec 23, 2013
10:03 PM EDT
I was happy to see this article anyways.

I forwarded this one to all my Windows-using, Linux-resistant friends and acquaintances -- with a strong* recommendation to follow those conveniently provided links to how to make a "System Repair Disk" for whichever version of Windows they're subjecting themselves to. Hopefully, it will save me from one of those inconvenient "emergency" tech-support requests.

(*) along the lines of, "If you can't be bothered to make a repair disk for your computer, then I can't be bothered to fix your computer, either."
mbaehrlxer

Dec 23, 2013
10:40 PM EDT
yes, yes (this is me enthusiastically nodding in the knowledge that the article is of use to some here), i didn't mind the article as much as just not knowing ahead of time that it was a windows tutorial. hence the suggestion to add a windows category for such articles. (a note in the excerpt would have also helped)

greetings, eMBee.
Ridcully

Dec 23, 2013
10:56 PM EDT
I hadn't even seen the title of the article until it turned up on LXer, and then found myself intrigued. Spot on I think, BernardSwiss; and it brought back memories and also explains why I am always uncomfortable now if ever I have to put a Windows based machine "on-line". It's a darn good idea of yours though, and I'll now send the link to a few friends of mine who have not yet shaken hands with Tux.

And yes, Mbaehrixer, while I agree it's not strictly Linux, it's a very satisfying thing to read if you are a Linux user and you can recognise all the horrible things that you once had to deal with but no longer worry you at all. Oh yes, MOST satisfying.

And while the general subject of internet security is on the table, I've got a curious one for everybody: Spamhaus. Okay, I run an openSUSE installation as my primary OS. A couple of weeks ago, I received an email from ostensibly a Chinese location and it seemed okay because it held the name of a mycological scientist with whom I worked during the year on a fungal project. So I replied and instantly was told I was blacklisted by Spamhaus and my Telstra connection for emails was frozen so I could receive but not send - my internet browsing was unaffected.

My guess is that my Chinese scientist friend has been compromised in some way, and I got caught in the backwash. I have no doubts as to his probity in this matter, because he is a respected mycologist at a major research establishment.

Sure, it only took me about 5 minutes to contact Spamhaus and figure out how to undo the blacklisting and there has been nothing since, but that one intrigues me. Apparently just the act of replying to that particular email address triggers Spamhaus - but how the blue blazes does one get to know if a particular email address is a Spamhaus trigger ? If anyone has any clues on that one, I'd be delighted to know.
mbaehrlxer

Dec 24, 2013
12:12 AM EDT
wait, this sounds very disturbing. you were added to spamhaus after you replied? this makes no sense. if the email went to a legitimate address, how would spamhaus even know about it? the only way would be if your mail went to someone else and then reported you as spammer.

or is telstra reporting anyone who replies to spam? that sounds like a very questionable action. your mail wasn't spam, and should not have been reported as such.

the only way i can explain this is if your reply contained the original mail (or significant quotes of it) and it was detected as spam from from an automatic parser. to see to it that telstra customers are not sending spam does make sense, but it is still a fine line they are walking there.

greetings, eMBee.
Ridcully

Dec 24, 2013
12:18 AM EDT
Sorry Mbaehrixer, the exact events were as follows:

1. Received the email ostensibly from China......it had no attachments.

2. Composed an email in reply to the sending address.

3. Hit the transmit button and a message came up informing me that my address was now blocked by Spamhaus and the message would remain in my intray until further action was taken. I could now send NO other emails, they were all blocked. My internet browsing was untouched, it was purely emails.

Okay.........you tell me what happened ? I truly really don't know.
mbaehrlxer

Dec 24, 2013
12:30 AM EDT
(we are getting off topic for the original thread, so maybe this should be moved to the general forum?)

do you recall exactly what spamhaus reported on your address when you spent those 5 minutes to get yourself removed?

are you using your providers email service via imap?

did your reply quote from the original email?

did you verify that the address of your contact is correct?

if you try to send a new email (with different content) to your contact, does it pass?

(not sure if you want to try this:) if you resend the email that got you blocked. do you get blocked again?

greetings, eMBee.
Ridcully

Dec 24, 2013
1:17 AM EDT
Sorry eMBee......most of what you ask, I now cannot supply. I dumped the email, never kept a copy of the blocking message I received (it came in a pop-up window) and I never tried to verify the whole thing - frankly I was a bit too worried about getting a permanent block. My reply simply quoted the original email address. I do have the Research Facilities official email address and I will give that a go later on......If you want to have a Spamhaus thread on the Forum, fine with me, but there's not much more I can give you. My email goes out through POP3 to the Telstra server at mail.bigpond.com as far as I know.......I've never inquired further as long as it works.

Yes, I know this is off thread, but I had no idea if anyone would be interested....Perhaps it's worth a serious forum ?
mbaehrlxer

Dec 24, 2013
1:53 AM EDT
fair enough, maybe if this happens again (but lets hope not) you can try recording more detail for better analysis.

i had been wondering about the popup but that is probably a kmail "feature" to report the initial reply when sending the email to the server. with something like mutt, the mail is just sent out and the reply from the server if the mail is rejected comes back as a new email into my inbox.

greetings, eMBee.
Ridcully

Dec 24, 2013
2:23 AM EDT
Agreed. It's a problem I definitely DON'T go looking for. Email is simply too critical for me....I do have a GMail account, but I don't know if that was blocked as well......I don't use it much anyhow. Okay.....if it ever happens again, it's a forum thread....hopefully, it won't. Apparently, Spamhaus considered I was either a spam producer or a captive computer in a controlled network for sending spam. Either way, the organisation was wrong, but it still doesn't explain why the heck I was targetted. Thanks eMBee.
TxtEdMacs

Dec 24, 2013
7:53 AM EDT
When you requested the email block be removed, did you inquire why you were flagged for supposedly sending SPAM? Your exit from the problem just seemed too easy almost as if it was not your error. Wheres, sending copies to a myriad of random addresses, which would look like SPAM, but just one instance could be a valid trigger. Still very odd.
Ridcully

Dec 24, 2013
8:03 AM EDT
When you find the Spamhaus site TextEdMacs, you don't have any options other than removing your block. All I know is that you check to find out whether your address has been listed and under what conditions it can be removed......

http://www.spamhaus.org/lookup/

You proceed from there.....All I cared about at the time was getting my address cleared. Frankly, the whole thing frightened the heck out of me and I wasn't really thinking too clearly at the time other than to get my email fully operational again. I found the whole thing rather sinister, especially because I had done absolutely nothing wrong as far as I was concerned.

PostScript......Even worse was that I first tried to remove it via Telstra/Bigpond (my ISP)...got to an overseas consultant (yes, this Australian firm has outsourced all its tech services) and was politely told it would cost me $150 to have the block removed......somebody was pulling a con-job there.

Posting in this forum is limited to members of the group: [ForumMods, SITEADMINS, MEMBERS.]

Becoming a member of LXer is easy and free. Join Us!