Check these Pix out

Check these nature Pix out

(links removed see my post at the bottom)

have fun

[kato13]

Well this is an odd one. Looks like a human assisted spammer but I am not sure of the long term goals. Going to leave this for a bit to see what happens. I expect they will edit the post after it moves off the front page. I honestly cannot understand the economics of this model however.

For anyone curious about the pics (but don't want to click them) they simply look like tourists photographs of Egypt. There are even a couple on the site which might be considered on topic (A cargo plane with AA guns next to it) but I expect they are trying to drive traffic for Google Ads. Still makes very little economic sense given how little revenue that generates.

[pmulcahy11b]

They could be steganography, and contain malicious code. JPGs are notorious for the ease with which that can be done. Run your antivirus program, Kato, and anyone else who looked.

[copeab]

Originally Posted by pmulcahy11b

They could be steganography, and contain malicious code. JPGs are notorious for the ease with which that can be done. Run your antivirus program, Kato, and anyone else who looked.

Seconded.

http://www.dvhardware.net/article3194.html

There have also been cases where innocent-looking (or at least legal) "infected" JPGs have been used as a means to put kiddie porn on an unsuspecting person's computer, which is rather considerably worse than a visus ...

[simonmark6]

That might be a good point, Paul. I opened a file and I've been bounced with a trojan virus that has spread to others via my facebook account. There was also something strange on facebook about the same time so it could be coincidence but it's worth looking into.

[simonmark6]

Scratch that, the virus came from facebook, I've tracked it back.

Still, the post is strange.

[kato13]

Thanks for the warnings but the virus in a JPG is extremely over rated threat.

http://www.secureworks.com/research/threats/jpegvirus/

It's not a virus. The posted JPEG is actually a trojan downloader. It has no ability to spread on its own.

It only affects users with Windows XP Service Pack 1.

It's does not automatically execute on reading the message. The JPEG must be saved into a local folder, then the mouse pointer must be moved over the JPEG file's icon.

The file is detected by all major antivirus engines with current virus definition files. Because of the nature of the JPEG format, it is impossible to disguise an infected JPEG file.

The IP, domain and email are also not flagged in any malware or spam database I can find. That is why this is such an odd post. Before I chose to leave it I did look at all angles I could think of.

[pmulcahy11b]

Here's a possibility -- is he on our rolls? Maybe he posted the pics to the wrong group by accident.

[kato13]

Originally Posted by pmulcahy11b

Here's a possibility -- is he on our rolls? Maybe he posted the pics to the wrong group by accident.

It is a new person. They only registered, confirmed and posted. The timing pattern looks like a human assist spammer as no unnecessary pages were hit.

As far as I can tell the IP address/Email/Username has never been user for spam or malware. The domain that the links go to must be new and very small as there are fewer than 200 pics on the site. The originating IP of the "spam" was Egypt but the webserver is in the US.

Everything about this is just odd. Spammers usually throw up a dozen flags. My usual rule for deleting them is to check 3 flags (Bad IP, Username and Email address) of the 130 or so spam bots that have registered, only 1 (other than this one) have not had at least 2 of the 3 (and 95% had all). This one has 0 that is what is so vexing. Spam of any type, even to malware sites, is only effective in volume. We are a tiny fish so I don't see why we would be the only site they chose.

Unless a former/current nemesis of mine has appeared (cue dramatic music) just to mess with me .

The more likely explanation is someone is doing a very small test to see how effective spam is, but even then I would expect a 100 sites to be hit not just us.

Edit. Ok I am now seeing others getting hit. I guess somehow we were the first in line. I will ban the user and delete this thread after 24 hours.

Final Diagnosis most likely a Google Ad revenue generator.

I have submitted the email and IP to my spam databases.

[pmulcahy11b]

Originally Posted by kato13

Unless a former/current nemesis of mine has appeared (cue dramatic music) just to mess with me .

It's a communist plot to overthrow the forum!

(For you youngin's, when I was in my teens and twenties, everything was a communist plot...)

[Cdnwolf]

Originally Posted by pmulcahy11b

It's a communist plot to overthrow the forum!

(For you youngin's, when I was in my teens and twenties, everything was a communist plot...)

WRONG... its a Canadian plot to overthrow the forum and make everyone adore and worship snow!

[Cpl. Kalkwarf]

Originally Posted by pmulcahy11b

It's a communist plot to overthrow the forum!

(For you youngin's, when I was in my teens and twenties, everything was a communist plot...)

its stilla communist plot, they are just much sneakier about it.