[Operators] Attention: spammer/virus circulator using MUC

[Michael Grigutsch]

Hi!

We have a continuous problem with a spammer/virus circulator in various MUC-Rooms on at
least three servern.
- The Spammer registered his accounts at jabber.org (until yet)
- Joining all open channels on the server simultaneously, drop the message and leaving
(dropping connection?)
- Client resource is Psi
- After blocking the spamming account the spammer registered a new one and goes on.

examples (with shrouded URLs):

03-08 20:14 *** guli-guli has joined
03-08 20:14 <== <guli-guli> http://xxxx-xxxx-xx.blogspot.com/
03-08 20:14 *** guli-guli has left

03-10 14:57 *** guli-guli has joined
03-10 14:57 <== <guli-guli> http://xxx-xxx.blogspot.com/
03-10 14:57 *** guli-guli has left: Replaced by new connection

03-10 18:30 *** lo1ka has joined
03-10 18:30 <== <lo1ka> http://xxx-xxx.blogspot.com/
03-10 18:30 *** lo1ka has left: Replaced by new connection

03-11 21:19 *** lo1ka has joined
03-11 21:19 <== <lo1ka> http://xxx-xxx.blogspot.com/
03-11 21:19 *** lo1ka has left: Replaced by new connection

03-12 02:51 *** im1im has joined
03-12 02:51 <== <im1im> http://xxxxx-xxx.blogspot.com/
03-12 02:51 *** im1im has left: Replaced by new connection

03-12 06:51 *** im1im has joined
03-12 06:51 <== <im1im> http://xxxx-xxxx-xxxxxx-xxxxx.blogspot.com/
03-12 06:51 *** im1im has left: Replaced by new connection

Do NOT follow the original links, they are dangerous. You will be automatically redirected
to scanner.rapid-antivir-2009.com, a known trojan site reported by google:
http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=de&site=http://scanner.rapid-antivir-2009.com/35/?advid=2353&ref=&p=1000000000
Please inform your users.
Thank you.

Regards

/MiGri
-- 
-.. --- ...-- -... --- -..-
Michael Grigutsch - Dipl.-Rpfl. (FH) - DO3BOX - Linux User #77681
gpg/mail   -0x1554e086- E99F F50E B207 7BAC 07A9  DACB 342B FD8A 1554 E086
gpg/jabber -0xF5B8F7D9- E2DC A5FC CD05 523A 7ACC  74E8 F6A9 599D F5B8 F7D9