alan.fairhurst you haven't read the thread clearly enough & nor have you read the links left by members to explain what happens. ie: automated search results means that any search you do will come up with wmv & jpg results of the same name & of the above sizes. These should be ignored. Recognising this issue is what you need to do. Majority of these results come from T1 sources & are more often than not in the majority of results found.

These spams don't just come from spurious search results. Sometimes one gets legitimate search results (i.e. they are not from a T1 source, have only one or a handful of sources, and the filename isn't a simple derivative of your query) but downloading them results in a spam. It looks like the download "mesh" gets polluted too, and when you try to download a file from a "real" search result, sometimes a spammer gets in at that point and substitutes junk.

If Limewire sent hashes with search results and checked files against search result hashes it would catch these with "File corrupted", but it doesn't -- and lots of other broken files don't get detected either. Looks like it trusts the host sending the file to be honest about the hash and the file.

Thanks for the replies. I'm not very PC savvy but with your help I'm learning.

(Corrupt files is a different topic.) Um the images I posted on page 1 seem to show differently. But everybody for their own experiences. I've never seen any spam of any other size than those listed (well within 1 KB.) If you're looking for small wmv files then you're probably looking for porn. If that be the case then good luck. Sounds like you've unwittingly selected the wrong file to downld & then been surprised at the end to find it's spam. Either filter it out or be aware of the file size. It really is too obvious to the average user who has been using LW for any length of time.

Spurious search results need to be dealt with by ultrapeers rejecting them, not by end users blocking hosts. Blocking the spammers is a band-aid -- they've shown themselves able to move around and acquire a lot of network addresses -- somehow -- and anyway, the bogus results compete with legitimate results for limited network bandwidth. Ultrapeers need to start doing some sort of automated bitzi lookup or something, and when they have to pass on only a subset of the search results they've received, they can then dump the n lowest-rated results. So when search results get dropped, the spam will get dropped first.

Looks like Blarg's right about how to handle bogus search results, but he's left how to deal with spoofers polluting the mesh as an exercise for the reader. ;P

There was a thread I very almost linked to this one but without proof of the results I thought it best not to at this time. One person traced the ipod ads back thru several sections/links to a major telecommunictions company ... the largest one in that country. And so has it they were offering discount iPods (about 20-30% normal price) to those who joined one of their mobile phone plans (well it was either mobile phones or internet or cable or digital TV services. I found the latter out for myself b/c I was offered one. I just can't remember what it was they were selling off hand.

Perhaps that might be the reason (corrupted downld mesh) which certainly does or was known to in the past to have at least some issues. But I'd tend to disagree. How in all heck could it give auto-feedback with spam adds to the same websites & always the same sizes. It just looks to well setup & organised to have this effect for the benefit of those sites or their parent/ relative companies. Who has invested interests in www.clearoutclub.com or is it just a lolly pop to attract people to their business. Just a thought! lol

Some links to someone who knows what the spam is 1. Diallers (click on link), 2. Spam 2 ,
3. Spam 3 , 4. Spam 4 , 5. Spam 5 , 6. Spam 6 . All of these point to what these files are & why they should be either filtered out or ignored, but never opened!!! Some interesting discussions if you're interested!

It would explain how they have access to send those search results from such a huge variety of IP addresses.

I personally think it's AOL though. :P

I guess one just have to avoid downloading files that are extraordinarily too small for the file they are looking for. Like say for example a 364 KB Smallville EP4.wmv. Also try checking the "Browse Host" button if its on or lit if you click the file from the selection of downloads. If it's not then you can suspect that it may be a spam. And perhaps if we ever downloaded these type of files we should delete it right away so it won't be downloaded by other unsuspecting victims.

So that you are all aware I've been working on a solution to this problem solution by for filtering out results for those hosts. I've tested in my lab and it's pretty effective. I will keep you posted

__________________
Lee Evans, President
LeeWare Development
http://www.leeware.com

Too small works for the wmvs, but not the jpegs, as they are a typical size for legit jpegs. The spoofed results all have a name that's just your search term, perhaps with the capitalization changed and/or underscores inserted after every letter. It's easy to avoid them. Harder to avoid are spoofed files -- the search result is legit, but the file you end up with is bogus due to a spoofer participating in the mesh for the file. For example, you search for "foo" and go to get foo1.jpg, foo2.jpg, ..., foo15.jpg and all of them look normal except foo2.jpg and foo11.jpg, which are corrupt, or ipod spams, or those damaged-and-spammy sara18 or michelle18 images, or whatever. AFAIK the only thing you can do about those is delete them after the fact and retry downloading them until you get the genuine foo2.jpg and foo11.jpg that actually fit into the sequence with the others instead of the spoofed files.

I also recommend you make your shared and download directory separate and move files to the former only after previewing them. This avoids inadvertently sharing spam and damaged files, but moreover, it might keep your *** out of jail if you inadvertently download some mislabeled material that proves to be ... unacceptable. If you accidentally share something like that, you could end up in a bad situation trying to prove your innocence. To be sure you don't, don't share any file you haven't pre-screened for being acceptable. Preview media; virus scan executables. Anything unacceptable, secure-delete the file if you can, and definitely delete it.

I avoid downloading wmvs under 1 meg (or any wmvs for that matter, yuk) or jpegs that show dozens of sources, a T1 speed, and whose name contains all and only the words in my search query.

Despite this, I still occasionally get one of those ipod spams, as a jpeg that had not matched any of the warning criteria above -- it may well have shown only one modem source and been named with a query term missing and a word not in my query.

These can't be spoofed search results, but they are not legitimate either. So how can a legitimate search result not result in getting the intended file when downloading? Is it possible for a spammer to insert their garbage into a download without having generated the search result you used to start that download? How can they be stopped? I'm getting sick of this crap!

I get this too. It used to be easy to avoid that ipod crap -- don't download anything with a zillion T1 hosts whose name doesn't contain any words except only and exactly the ones in your search query. If it was from a cable host it was safe. If it had only 3 sources it was safe. If its name didn't contain a word from your search it was safe. If its name contained a word you never used in your search it was safe.

Not anymore. Now it seems the mesh is being polluted too -- every batch of files I get contains at least one ipod spam that looked like a legitimate, normal, non-spoofed result in the search I did.

How do I keep these F*#!ING THINGS OFF MY F&*!ING HARD DRIVE! It's MY COMPUTER! I DECIDE! I WANT THESE THINGS GONE! NEVER AGAIN! HOW DAMMIT?!

I could Bitzi lookup all the files in every single search, but that would TAKE FOREVER, not to mention Bitzi isn't very dependable -- I checked a bunch of known spams and maybe half of them had bad ratings on Bitzi and the rest were simply "unknown".

I NEED A BETTER SOLUTION. NOW GODDAMMIT!

Has anyone noticed that the spammer seems to be on at certain times of day? It's enough to make a guess that they live in the eastern time zone of north america.

In fact it's rather strange -- surely the spam operation is automated and could operate 24/7 with a minimum of supervision? Yet the spammer disappears shortly after midnight eastern time, which suggests otherwise. Only one type of computer system is that incapable of remaining up for any length of time unassisted by a human. The spammer is running Microsoft Windows ME without any service packs.

GAAAAHHH

Can anyone tell me how the hell this is being done?

Isn't it enough to send 40 or so bogus results for every search? Now the *******s have to start substituting their spew for normal images as well?

I just found an ipod spam in my download directory titled "Resident Evil Front Cover.jpg". I did not do a search for "resident evil front cover" or any permutation thereof. It can't possibly have been me accidentally clicking on on of those bogus results. So where the HELL did it come from? It seems the following has occurred...

1. Someone that isn't the spammer has a file titled Resident Evil Front Cover.jpg. Presumably, this file is legitimate, since they aren't the spammer and therefore wouldn't be sharing it if it weren't.
2. My search finds this file. (It was for generic cover art.)
3. I go to download the file.
4. Somehow something goes wrong at this stage, and it starts downloading from the spammer instead of from the guy with the real "Resident Evil Front Cover.jpg" file.

How does step 4 happen? How does the spammer hijack downloads for normal files and not just put in their own spoofed search hits for their not so normal files? And how the hell can this attack be stopped? Avoiding the bogus search results is easy. But if any ordinary jpeg or wmv whatever can get hijacked en route and substituted with the dreaded ipod, there is no escape is there???