Hey ..Bob !

Bob,

I have close to 5 MB worth of e-mails containing the sobig.f
virus apparently sent by Pietro, just from the last day or so.
I'll help in any way I can. What I really want to do is take
this up with Pietro's parents. They undoubtedly paid for his
computer and everything else he has.

-- Jeff, in Minneapolis

..

Bob Officer wrote:
ANTIVIRUS

All three match...

oh yeah ! match ..this !

BTW don't e-mail me again.... Ever!



Hey..! say to your friend Jeff..that you are bother me.
There is no way that I send virus to somebody because :
I've a computer system that will "kill" all the virus that you send to
me every day, so it is impossible that I've infected somebody. Do you
wanna take it up with the laws ..?
So ... don't waste yourself..punks !

judoka_61

Bob Officer wrote:

On Sun, 31 Aug 2003 08:28:18 +0100, in sci.astro,
wrote:

Bob Officer wrote:

On 25 Aug 2003 11:46:41 -0700, in sci.astro, (Pietro
Sommavilla) wrote:

.. you and Wally are the same person !

thanks to entertain me !
judoka_61

and you pietro, like to send people virus?

I don't think he did it deliberately - he may be stupid but probably
not that stupid )

Really? I hope not.

I started to complain to his provider. I know he has taken up stalking me,
but checking out of groups where I have posted.

I suspect Pietro is a sick little ****. Pardon my language but I have run
into his sort before. Jay Stevens has also done the same thing in the past,
mailed virus to people that posted articles he didn't like.

Nah, I think he's just a dim-wit kid. There's no real malice in his
postings, and I don't think he'd have the patience to stalk anyone.

He is however stupid enough to get infected with it....

No fooling. I got bombarded with dozens of mails. The fact it used my ELN
addy as the From: line is puzzling. I know it was Pietro because I got the
IP addy off the headers of the virus he sent me.

BTW your system protection is good.

The best protection is to use non-microsoft software )

I got bombarded with it, as did a lot of others in newsgroups he
"frequents", although why our names should be in his address book when
he's not in direct contact with us is a question only he can answer.

I was trying to figure that out too. He uses Google to post from so the
addresses should be in his MS address book. Curious, isn't it.

What's even odder is that I got a lot of bounces at my work address
too. I never post to usenet from it, and the only way he could have
got it is from one of my sigs.

Maybe he copies every address he comes across into his address book
"just in case". From all the bounces I've probably got a large part
of his address book now, and a lot of them look like that - taken from
usenet and web sites. Additional evidence for the dim-wit kid theory
I think )

I guessed it was him from the list of addresses, many of which were
Italian or other European domains.

The 62.101.64.106 is the same IP he uses to post from Google.

The ones I got at work today were from 62.101.64.58, which resolves to
Grazianet.com - an Italian network company that may be his ISP,
although they also seem to own internet cafes, so he may not be using
his home computer. Maybe his mum won't let him

But the X-mailscanner didn't detect the attachments as the sobig worm.

Try Norton - they're usually pretty quick with updates for new
viruses.

Presumably he's now got some virus protection software running, since
it seems to have stopped.

I certainly hope so. That address got hit with 45 virus attachments in 12
hours. and nearly 35 rejection messages or warnings about sending info with
virus.

It doesn't look like it - I got a load more today.

Hey Pietro! I know you're probably reading this, so why not do us all
a favour, and go to this url :-

http://securityresponse.symantec.com...oval.tool.html

(http://tinyurl.com/kjvw if it wraps)

and get the virus removal tool. Run it on your own computer, or give
it to whoever runs the internet cafe and tell them to check their
machines.

ELN even sent me a message someone complained about me sending virus
attachments, and It wasn't until I pointed out the IP addresses it dawn on
them is the joejob.

I'm surprised they didn't realise, with the number of viruses doing
that lately. My ISP seems to have a grasp on all this, and even knows
that spammers are using the same trick.

Anyway, the virus is due to deactivate on 10th September so we should
get peace after that - until he gets infected again )

DP

--
David_Paterson = ¦ ;

Senior programmer There are three kinds of people in the world -
Visual Science Ltd. those who can count, and those who can't...

wrote in message . ..
Bob Officer wrote:

On 25 Aug 2003 11:46:41 -0700, in sci.astro, (Pietro
Sommavilla) wrote:

.. you and Wally are the same person !

thanks to entertain me !
judoka_61

and you pietro, like to send people virus?

I don't think he did it deliberately - he may be stupid but probably
not that stupid )

He is however stupid enough to get infected with it....

I got bombarded with it, as did a lot of others in newsgroups he
"frequents", although why our names should be in his address book when
he's not in direct contact with us is a question only he can answer.

I guessed it was him from the list of addresses, many of which were
Italian or other European domains.

Presumably he's now got some virus protection software running, since
it seems to have stopped.

DP

Ladies & Gentlemen finaly...they did understand that I use to post in
an internet cafe..and moreover that the virus will die tha 10 sept. o
my goddess
what happen ? and still they say that I Got infected..!
no way ! anyway I told to the guy in the cafe and he told me that you
are delirius..so I guess I can't help you maybe it is just your
karma...

hasta la vista ! loosers !

judoka

"Jeff Root" wrote in message
m...
Bob,

I have close to 5 MB worth of e-mails containing the sobig.f
virus apparently sent by Pietro, just from the last day or so.
I'll help in any way I can. What I really want to do is take
this up with Pietro's parents. They undoubtedly paid for his
computer and everything else he has.

-- Jeff, in Minneapolis

Jeff,

I don't know lots about the propagation of viruses and worms, but I do
know that a number of them have been sent to others, apparently (but not in
fact) from my e-mail address. I also have gotten a notice that I, along
with a number of others I recognize from another ng (and some I don't
recognize) were sent the virus from an identified person that I've never
heard of in my life. I have no idea about anyone else, but I've never sent
a virus (at least knowingly) in my life; but some folks might well think
otherwise if they only judge by the "from" line in the e-mail.

I use Norton Anti-Virus, and go to the update site at least four or five
times a week. I've configured it to scan email (in and out), and anything I
download. I use ZoneAlarm to close ports that might otherwise allow access
to bad people and programs. For the last month or two, I've been using
MailWasher, so I don't even download headers from spam or possible virus
e-mails. I run a full system virus scan at least once a day.

And still my e-mail address has been hijacked in the service of the
latest round of viruses and worms.

Pietro might have been silly or stupid or evil enough to actually send
viruses; but I prefer to think it's just the current 'flu' that's going
around, and not malice from our little Italian.

OTOH, almost all of the notices I've gotten in the last few days of
viruses that had been sent to my account said that the originating ISPs were
Italian. I don't know what to make of that, but at least several different
..it ISPs were in the mix.

Tom McDonald

On Mon, 01 Sep 2003 23:55:13 +0100, in sci.astro,
wrote:

Bob Officer wrote:

On Sun, 31 Aug 2003 08:28:18 +0100, in sci.astro,
wrote:

Bob Officer wrote:

On 25 Aug 2003 11:46:41 -0700, in sci.astro, (Pietro
Sommavilla) wrote:

.. you and Wally are the same person !

thanks to entertain me !
judoka_61

and you pietro, like to send people virus?

I don't think he did it deliberately - he may be stupid but probably
not that stupid )

Really? I hope not.

I started to complain to his provider. I know he has taken up stalking me,
but checking out of groups where I have posted.

I suspect Pietro is a sick little ****. Pardon my language but I have run
into his sort before. Jay Stevens has also done the same thing in the past,
mailed virus to people that posted articles he didn't like.

Nah, I think he's just a dim-wit kid. There's no real malice in his
postings, and I don't think he'd have the patience to stalk anyone.

Does that account for him showing up in other groups I post in? I wouldn't
think he would be in us.config, would you?

He is however stupid enough to get infected with it....

No fooling. I got bombarded with dozens of mails. The fact it used my ELN
addy as the From: line is puzzling. I know it was Pietro because I got the
IP addy off the headers of the virus he sent me.

BTW your system protection is good.

The best protection is to use non-microsoft software )

I use Eudora for all my mail needs.

I got bombarded with it, as did a lot of others in newsgroups he
"frequents", although why our names should be in his address book when
he's not in direct contact with us is a question only he can answer.

I was trying to figure that out too. He uses Google to post from so the
addresses should be in his MS address book. Curious, isn't it.

What's even odder is that I got a lot of bounces at my work address
too. I never post to usenet from it, and the only way he could have
got it is from one of my sigs.

Yep...

Maybe he copies every address he comes across into his address book
"just in case". From all the bounces I've probably got a large part
of his address book now, and a lot of them look like that - taken from
usenet and web sites. Additional evidence for the dim-wit kid theory
I think )

That's pretty good proof...

I guessed it was him from the list of addresses, many of which were
Italian or other European domains.

The 62.101.64.106 is the same IP he uses to post from Google.

The ones I got at work today were from 62.101.64.58, which resolves to
Grazianet.com - an Italian network company that may be his ISP,
although they also seem to own internet cafes, so he may not be using
his home computer. Maybe his mum won't let him

That's the IP he mailed me from...
I really think he is very dimwitted.

But the X-mailscanner didn't detect the attachments as the sobig worm.

Try Norton - they're usually pretty quick with updates for new
viruses.

I have norton's setting on the system gateway. It does a good job of
filtering everything for me.

Presumably he's now got some virus protection software running, since
it seems to have stopped.

I certainly hope so. That address got hit with 45 virus attachments in 12
hours. and nearly 35 rejection messages or warnings about sending info with
virus.

It doesn't look like it - I got a load more today.

I haven't looked yet... I am almost afraid...

Hey Pietro! I know you're probably reading this, so why not do us all
a favour, and go to this url :-

http://securityresponse.symantec.com...oval.tool.html

(http://tinyurl.com/kjvw if it wraps)

and get the virus removal tool. Run it on your own computer, or give
it to whoever runs the internet cafe and tell them to check their
machines.

ELN even sent me a message someone complained about me sending virus
attachments, and It wasn't until I pointed out the IP addresses it dawn on
them is the joejob.

I'm surprised they didn't realise, with the number of viruses doing
that lately. My ISP seems to have a grasp on all this, and even knows
that spammers are using the same trick.

ELN... The admins are often lacking in experience!

Anyway, the virus is due to deactivate on 10th September so we should
get peace after that - until he gets infected again )

and some other kid will hack and try to be famous.


--
Aktohdi

Thomas McDonald replied to Jeff Root:

Pietro might have been silly or stupid or evil enough to actually
send viruses; but I prefer to think it's just the current 'flu' that's
going around, and not malice from our little Italian.

OTOH, almost all of the notices I've gotten in the last few days of
viruses that had been sent to my account said that the originating ISPs
were Italian. I don't know what to make of that, but at least several
different .it ISPs were in the mix.

Tom,

If you skipped over it, read my first post in this thread.

I received 55 e-mails within 24 hours of announcing here in
sci.astro that I had changed my e-mail address. The first
of those was from 65.54.195.216, which I suspect is Pietro.
48 e-mails were sent from 62.101.64.58, which is the IP address
Pietro is currently using here. The remaining six e-mails were
notices that e-mails I had supposedly sent were undeliverable.
All of those which included the original sender's IP address
showed it to be 62.101.64.58.

All the e-mails arrived in three batches, as though they were
generated in three groups-- namely, when Pietro was on his or
the Internet cafe's computer.

One of the e-mails had my old address (jeff2) as the sender,
and, of course, all of the undeliverable e-mails had my new
address (jeff5) as the sender. None of them had any of
Pietro's aliases as the sender.

-- Jeff, in Minneapolis

..

wrote in message . ..


Ladies & Gentlemen finaly...they did understand that I use to post
in
an internet cafe..and moreover that the virus will die tha 10 sept.
o
my goddess

Well, if you'd told us that in the first place it would have saved a
lot of hassle. So, why do you use a cafe - is it because your parents
wouldn't let you off with the crap and attitude you post with here?


Ok, first of all; someone "smart" like you debunkers had to figure out
that for avoid "problem" I did not post from my computer in groups or
chats.
Why ? because I had a bad experience a couple of year ago
(I had to trash a new computer) and also someone can track me
down.

And the current incarnation of the virus will stop posting on 10th
Sept. but it'll still be around and might be reactivated in the
future. It's quite a complex virus, and can receive updates from an
external source which could change what it does.

This is pointeless:you think that I'm guilty..and I'm not.
I'm also sure that something is wrong with )
because
was impossible to me post in google and yahoo while more than one time
I found
that someone open and trash my E.mails so I was waiting to get the guy
and I fail to get him. Now I'm serius I'm starting to think that could
be a dude from the internet cafe ( an asian guy that I argued with)
and maybe,he did get in my yahoo account.As a matter of fact I post
from today from another internet cafe (easyinternetcafe in Milan)

what happen ? and still they say that I Got infected..!
no way ! anyway I told to the guy in the cafe and he told me that
you
are delirius..so I guess I can't help you maybe it is just your
karma...

Or maybe you're deliberately sending the virus to people and forging
the return address?

No it is not my style (I am not a coward)

Maybe I should mail Grazianet and ask them if they've checked all
their Milan computers for this virus? Maybe I should ask them to have
a look at your logs and see what you've been doing?

Yes do that.

Maybe I should contact a few of the hundred or so other names in your
"address book" and see if they're getting the problem as well?

Do that, I'll give to you my OK

Maybe I should post the list here and see if anyone else recognises
the names on it?

hasta la vista ! loosers !

I think, having tracked the "outbreak" back to you, we're not the
"loosers" here....


Yes you are loosers why ?

You harassed me more that one time...you called me names and in the
end now you look like some jerks.

ciao (let me now)

judoka

On 2 Sep 2003 07:23:45 -0700, in sci.astro, (Jeff Root)
wrote:

Thomas McDonald replied to Jeff Root:

Pietro might have been silly or stupid or evil enough to actually
send viruses; but I prefer to think it's just the current 'flu' that's
going around, and not malice from our little Italian.

OTOH, almost all of the notices I've gotten in the last few days of
viruses that had been sent to my account said that the originating ISPs
were Italian. I don't know what to make of that, but at least several
different .it ISPs were in the mix.

Tom,

If you skipped over it, read my first post in this thread.

I received 55 e-mails within 24 hours of announcing here in
sci.astro that I had changed my e-mail address. The first
of those was from 65.54.195.216, which I suspect is Pietro.
48 e-mails were sent from 62.101.64.58, which is the IP address
Pietro is currently using here. The remaining six e-mails were
notices that e-mails I had supposedly sent were undeliverable.
All of those which included the original sender's IP address
showed it to be 62.101.64.58.

All the e-mails arrived in three batches, as though they were
generated in three groups-- namely, when Pietro was on his or
the Internet cafe's computer.

One of the e-mails had my old address (jeff2) as the sender,
and, of course, all of the undeliverable e-mails had my new
address (jeff5) as the sender. None of them had any of
Pietro's aliases as the sender.

It shows Pietro is very stupid. there would be no reason for your old
address to be in an address book on a new internet cafe machine.

Pietro has used 62.101.64.106 and 62.101.64.58 to send virus out using a
hand carried address book. ( I almost think he is using a laptop with a
wifi card to visit the cafes.)


--
Aktohdi

Bob Officer wrote in message . ..
On 25 Aug 2003 11:46:41 -0700, in sci.astro, (Pietro
Sommavilla) wrote:

.. you and Wally are the same person !

thanks to entertain me !
judoka_61

and you pietro, like to send people virus?



....and you Bob like to talk too much why don't sue him ?
you got enough evidences !
you can win the case !

judoka ----61 oct 26 (d.o.b.) you have my photo in yahoo profile


ps hey Bob ! make my day !