i am leaving nyc

i was more of a dingo the dog man myself

thread not deleted yet?!

Ok, so the good news is that I *don't* have skin cancer so I'm staying in nyc.

im leaving today my flight takes off at 3:20

Congratulations on not having cancer! Drinks and smokes all around!

xp Gud-bye, Maxie.

yay, jw

I am leaving, I am leaving
But the Catsupp still remains
Lie la lie

bye max!!

im in the airport right now

hi i'm in jfk for a few days

newark

i guess i was more leaving new jersey. the tri-state area.

oh shit i'm going to lga to pick someone up now! boo.

PANOPTICON

ALERT! before fleeing city does anyone want to go to Lupa tonight @ 5:30? last min cancellation from one of our dinner friends!

we left today, tho still in state. really fun seeing everyone @ dan's ambient night, and also at cake shop. I have decided I will possibly move to nyc sometime.

oh man, sorry this week flew by. I meant to get in touch after the show, we left asap afterwords because I was worried finding parking near my house (a problem most NY'ers don't worry about). Did you make it to Academy in williamsburg?

man, never ended up going record shopping, trip was just too crammed together w/travelling and meeting people we were supposed to meet. I want to come back tho, hopefully before the end of the year. things I learned: nyc radio plays alicia keys every 10 mins; nyc is fun and good

http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20080128

The Storm Worm doesn't just rotate its binaries, it rotates it stock pump & dump scam images too!

When it comes to deceiving Anti-virus vendors, e-mail Spam filters, and end users, it seems like the authors of the Storm Worm have a never ending bag of tricks. Maybe they have been using this latest trick for a bit now, but we just took special note of it with their last stock Spam run that has just ended.

Some time ago Storm Nodes started serving up the same image for any file with a ".gif" extension that was requested regardless of what the filename was. For example, making a GET request to a Storm node web server (by IP address) for random_image123.gif would return the same image as making a request for abc1234.gif. Never will you receive a 404 error. For the last month or so it had been serving a stock pump and dump image we described in a post on January 7th at http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20080107.

However, in the last few days the image changed right as a new wave of pump and dump stock Spam e-mails were blasted out from the Storm Worm network. This latest image was for a new stock by a company called Cyberhand Technologies with an OTC stock with the symbol CHYA (as advertised in the Storm Worm spam). Still this is nothing new right? Just Storm Worm nodes hosting images for a new pump and dump campaign...interesting but nothing new.

Not exactly. There is one small twist to what it is doing now. Much like the binaries that Storm Worm host, the images it hosts are now also changing -- only a lot more frequently. Requesting a .gif file from a Storm node yielded a 760x567 image of the latest stock scam with a blue background. Then hitting 'refresh' now presented with the same scam but on 480x731 image with a pink background. Hitting refresh over and over kept yielding different dimensions and colors, but always with the same message. These same images found themselves into the e-mails the network was having spammed out. Looks like an interesting way to avoid Spam filters as, the image changed almost every time the refresh button was pressed. It is very well possible that the Storm Worm has been doing this for some time, but we caught them in the act on their web servers and just wanted to pass it along.

THE SAGA CONTINUES
WU-TANG

-- sanskrit, Thursday, January 17, 2008 2:31 AM

rice in nose now

thx for that

i am now an official temporary exile

(with no means of returning)

Where are staying right now?

With your sister?

in the hospital, eighth week begun

my stuff is with her

i'm sure it's not consolation but it's not like you're missing anything right now