unforum

[fog]

[kenbo]

[bill.at.deaddrop]

confusion about shora

[Robert]

Damn ... it logged me out again. Must be a cookie thing.

Anyway, that post above is from me.

[arcanadei]

I would seriously avoid the Shora thing for the time being. The convo on ICQ sounds very botlike and there is a call in their source called govuln. There is no reason I can think of that Opera would be necessary unless there is a specific exploit they are trying to use. Since it immediately tried to DL a file to me when I pulled it up and redirected to localhost, I am betting it's a viral thing. Until someone more experienced looks at it, stay away! I don't see any connection to Lucrezia in this...

[Robert]

Ok, I think I may have answered part of my own question:

http://www.genevapunkska.com/region.html
http://membres.lycos.fr/hardcoremsf/shora.htm

These reference a heavy metal band named shora, and they link to www.shora.com. I have seen the 8puzzle graphic on shora.com but not on shora.org. In fact, on shora.org I just got a strange animated gif and some javascript code...

Blacklight, are you sure this graphic came from shora.org? If so, does that mean that a heavy metal band might be runnning this?

[Robert]

Ok, I think I may have answered part of my own question:

http://www.genevapunkska.com/region.html
http://membres.lycos.fr/hardcoremsf/shora.htm

These reference a heavy metal band named shora, and they link to www.shora.com. I have seen the 8puzzle graphic on shora.com but not on shora.org. In fact, on shora.org I just got a strange animated gif and some javascript code...

Blacklight, are you sure this graphic came from shora.org? If so, does that mean that a heavy metal band might be runnning this?

[qrunchmonkey]

shora.org seems VERY maliscious. It downloaded something called "server.exe" - which, out of curiosoty, I launched. I really don't think this is in-game. Infact, now I think I'm probly infected with something. (it appears to have added registry entries. - I'll edit with more info if I find it.)

[arcanadei]

Shora.org has a script running that looks very similiar to this old IE exploit but modified to use ActiveX. Fair warning, stay away from Shora.org.

[Robert]

Yeah, shora doesn't appear to be the safest lead at the moment.

I suspect that figuring out geocities is still pretty major, when it comes to this ARG.

[Blacklight]

Well the first thing this morning, my virus scanner found an expolit called Coreflood.dll. I'm assuming that that is the malicious code everyone is talking about. It's a virus that aids in launching a denial of service attack. Knowing what you guys noticed from Shora.org, I assume that is where it came from. That said.. I am beginning to think that this is not part of the "game". It's probably a spammer/exploiter trying to mimic an ARG contact. It seemed at the time very botlike, but I didn't know at the time if it was because a PM didn't speak english well like the emails in the MBOX messages.

Anyawy.. there is no reason to go to Shora.org anyway. I posted the only thing there and the html on the site has no info in it. Please run an updated virus scanner if you have been there. The SERVER.EXE is the virus installer I think.

The wierd thing is.. that shora.org seems to contain some kind of puzzle in that jpeg. I've deleted all references to that site, but I still want to take a look at that shora logo jpeg. It's also possible that the web site could have been infected from an outside source and that this jpeg is part of the game. I'd like to at least rule that out anyway. I will look at it further when I get home tonight.
The other thing is, the spammer wanted me to add them to MY contact list, not the other way around. That is unusual. I am still not convinced 100% that this is not game related yet unless I find or see something to the contrary.
Once again.. DON"T GO TO SHORA.ORG. THE JPEG from the site is posted here !!! (for anyone who didn't pay attention to all the earlier warnings )

[Guest]

Unknown and Ame

mbox.txt

Unknown:
ame ame ame. i did as you asked me and deleted the emails from the
reception's computer so that nobody knows we meet. i will save some
emails on the palmtop, after removing the headers. as you said, "you
will learn", i am learning. ame ame ame, i will always remeber you
tapping at my room's window. sorry for my bad english and my
fragility. should go now or they'll catch me

i think i love you ame,

Ame is Japanese for rain. Perhaps Unknown is Japanese. Or maybe s/he is only bad at english and speaks nothing else. Unknown has a palm with old e-mails on it. Who is "they"? She apparently emailed from the receptionist's desk. Very interesting is "i did as you asked me and deleted the emails from the
reception's computer so that nobody knows we meet. i will save some
emails on the palmtop, after removing the headers.", "as you said, 'you
will learn', i am learning.", "i will always remeber you
tapping at my room's window", "sorry for... my fragility" and "should go now or they'll catch me"

Ame:
You don't have anything to sorry for. My english is even worse
than yours but that's something we have in common. That and the scars on
our wrists and the pills they're giving you every six hours. And the
four fingers on our left hands. I am still amazed at that. Destiny
probably exists.

Be strong. Think about something good. Your sister? You said you really
love your sister. Think about how happy you'll be when you'll meet her
out of that clinic. I will be there too.

I like that name you gave me, love,
Ame

Ame claims his/her english is bad, dispite that it clearly isn't. S/he also says that they both have scars on they're wrists and they both have only 4 fingers but "they" are only giving Unknown the pills every 6 hours. S/he still lists it as something they have in common though. Every 6 hours is 4 times each day. Unknown is in a clinic and has a sister, who s/he loves. Her sister is apparantly not in the clinic. Unknown gave Ame his/her name, and appearently s/he was nameless before that. Interesting: "I am still amazed at that. Destiny
probably exists."
"Think about how happy you'll be when you'll meet her
out of that clinic. I will be there too."

Unknown:
tha new medcine feel like spiders under my skin. they keeps asking about
fire and my parents and full monn.
help me ame make it rain for me make it rain rin. please+¿¿ %.

it hurts now, but hurts somebody else. the rain steals moonlight. the drops
dance like crazied faeries just outside of my window. the beds here are of
iron, did you know? so hard so hard. surely you did ame. you're the rain
dancing outside of my window.

Unknown's english is worse than normal. Is Rin a name or is it a misspelling of rain? He/She has apparently switched medication, or maybe she is referring to just her last dosage. Does Ame have the power to make it rain? We know he/she is human because he/she has one hand with four fingers. Interesting: each of the sentences in the second paragraph

Ame:
I hope you're better now. My parents are.. we're moving. Keep the cell phone
well hidden and don't give them any reason to take the palm your parent gave
you from you. Still don't know where we'll go but when it'll rain I will
always be at your window, like the first time. Take care of you. Ame.

What first time? Ame is apparently with his/her parents and moving. Unknown has a cell phone which "they" apparently don't know about. "they" know about her palm with the stripped emails, which apparently her parents gave him/her. She shouldn't give "them" (not the ants) any reason to take it away.
"when it'll rain I will
always be at your window, like the first time" is interesting, as well as "don't give them any reason to take the palm your parent gave
you from you"

Unknown:
little droplets red as blood in the setting sun are falling down. where are you? ame. i ned you.

interesting, but I can't get anything from it.

Ame:
We're in Paris now. I am§|

Ame is in Paris, but we don't know what else she is.

Lucrezia Ricci

first emails

All headers were stripped of headers(except the from address), like the messages on Unknown's palm. Perhaps they are from Unknown, or an earlier Ame.

1
From: tolmhbeSPLATyahoo.it
To: undiscosed recipients;

Here comes a spider under my skin. It was rain and rain and rain
washing my clothes clean. Only they weren't my clothes. How clean
can a soul be? Beautiful soul, leave me alone.

Rain. Rain. Rain. This is not a game.

We now know the spider is medication. And rain may be Ame.

2

From: tolmhbeSPLATyahoo.it
To: undiscosed recipients;
Go ahead says the spider. Spider ahead says my head.
Rain rain rain. Where are you today? tic-tic-toc used to say.
Rain pouring down on the glass, will'o'wisp dancing the night.
And you were. Just. There.

I can't make anything out of this

3
August 2, 2004 3:19:56 PM PDT

This is probably just a test. Or maybe not. Surely this is not a game.
It can be an email. Intangible are those electrons moving like drunk
ducks through my toughts. World is shattering and shards of reality
are punching and tearing at my dreams. Is that liberty? Or just marble.

Cubes, only cubes pouring from everywhere. And the rain.

This has very good english. Can't make out anything else. Note that "This is not a game appears again.

Conversation with Lucrezia

From: Cyfre
To: TolmhbeSPLATyahoo.it
Subject: (none)

Don't be afraid of snakes in the garden
when there are spiders in your bed.
Don't try to block out the memories
because they are already in your head.
In the shadows where they play.
You can run and hide in the day
but come night there's a price to pay.

From: TolmhbeSPLATyahoo.it
To: Cyfre
Subject: please stop

Mr. Meeks,

yours is second email I receive with some rhymes
in it. my friends suggested using orkut to find
other people interested in architecture
and i did not wanted to just "meet friends".

I use this email address mostly for work so, can you
please stop writing me? I will be out for work for
about 10 days, so i will not be able to answer you
anyway.

Note: first paragraph and subject is all lowercase, second's capitalization is fine. It says that Cyfre's email is the second email she received. Capitalized says that she will be gone for 10 days and she uses the email mainly for work, Lowercase metions orkut and architecture without any mention of orkut. The two paragraphs seem not to realize the other is there.

From: TolmhbeSPLATyahoo.it
To: Cyfre and fog
Subject: please stop bugging me
Date:

four emails about bugs and snakes and spiders are more
than enough. i use this email for work and i don't
want to have it filled with your stupid messages. i
will unsubscribe from orkut, but please stop.

Entire message by Lowercase. This time says there are four messages and mentions work. She says she will unsubscribe from orkut, but apparently still hasn't. One of the emails was by fog.

From: Cyfre
To: TolmhbeSPLATyahoo.it
Subject: Re: please stop bugging me

I sent you one e-mail, which you responded to asking me to stop. So i stopped. =) Let me explain to you why you are receiving these strange e-mails, okay? There is a website (http://www.unfiction.com/) that people frequent, people who are interested in ARG (Alternate Reality Gaming). For an explanation of Alternate Reality Gaming, feel free to visit unfiction.com. At any rate, someone started a message thread that they received an e-mail from your address stating the following:

From: tolmbeSPLATyahoo.it
To: undisclosed recipients

Here comes a spider under my skin. It was rain and rain and rain washing my clothes clean. Only they weren't my clothes. How clean can a soul be? Beautiful soul, leave me alone.

Rain. Rain. Rain. This is not a game.


The person who received this e-mail thought it was definitely a strange e-mail, and thought it might be a lead-in to an ARG. So, they posted it on this message board looking for assistance. The people you mailed you, likely did it to find out whether this was part of an internet game or not. Your response of "please leave me alone" is more than enough to convince me that this is not part of an ARG.

I won't bother you again, and i apologize for any inconvenience my ONE e-mail may have caused. But i won't take responsibility for the other three e-mails you received. I will, however, post on the message board that you do not want to receive any more e-mails of this nature. If you are interested in viewing the message thread, please cut and paste the following address to your browser:

http://forums.unfiction.com/forums/viewtopic.php?t=5185

Thanks,
Nathan
Florida, USA

PS- All of this has nothing to do with Orkut. Infact, i had never heard or Orkut before you mentioned it in this e-mail!

From: TolmhbeSPLATyahoo.it
To: Cyfre
Subject: Re: please stop bugging me

> According to the person who initially posted the
> message, they found it in
> the e-mail you wrote them!

this is so strange... i feel like i ought to remember
something but i don't know why.

don't worry for my flight, i was only delayed a couple
of days and i'll depart tomorrow. no strange emails
for at least 20 days!

lucrezia

By Lowercase. Again. First paragraph is interesting. We now know that she is traveling by air and departing the next day (unless delayed again). According to Lowercase she is going for 20 days as opposed to Capitalized's 10 days. This also shows that Lowercase recognizes the leaving.

From: Cyfre
To: TolmhbeSPLATyahoo.it
Subject: Re: please stop bugging me

> Here comes a spider under my skin. It was rain and
> rain and rain washing my
> clothes clean. Only they weren't my clothes. How
> clean can a soul be?
> Beautiful soul, leave me alone.

According to the person who initially posted the message, they found it in the e-mail you wrote them! I have personally never heard it in my life, but i do agree that it brings a number of images and feelings to mind. It's kind of a nice little verse, if you ask me. =)

You don't have to apologize for the way you reacted. I'm sure i would get a little bent out of shape if i started receiving all these strange e-mails about spiders for no apparent reason. And i'm sorry to hear your flight was cancelled! Hope things work out for you in the future.

Thanks, Nathan

From: TolmhbeSPLATyahoo.it
To: (me)
Subject: ...

Don't. Trust. Her. Nathan.

By Capitalized. Tells us not to trust someone. I think Lowercase. Or Maybe this is the PM throttling us for being so dumb.

Later, Blacklight decided to email her.

From: TolmhbeSPLATyahoo.it
To: Blacklight
Subject: Re: Curious
Date: Mon, 30 Aug 2004 10:49:38 +0200 (CEST)
--- Scott ha scritto:
> I am just curious if you figured out who was
> spamming from your email address. It appears that a
> friend of mine was getting some strange emails from
> your email address. I was wondering if it could be
> one of your co-workers using your computer ?

I am a freelance architect, I don't have a coMputer
that can be used By co-workers. I kind guy wrote me
sOme time ago eXplaining this was all some sort of
game but iT is not a game for me.. So, please, eXcuse
me, but I do not want to receive more mail abouT that.

By Capitalized. She seems to actually know what is going on but is pretending she doesn't, maybe to trick Lowercase. Or maybe the capitalization is subconsciously forcing itself out. Or 0822162710052 was supposed to lead us to mbox.txt and we missed it, so the PM toned it way down, possibly going out of character. The capitalized letters(besides normal capitalization) MBOXTXT, which hints toward a file on her website(http://www.geocities.com/tolmhbe/. The file is http://www.geocities.com/tolmhbe/mbox.txt, the second, http://www.geocities.com/tolmhbe/mbox.1.txt. Capitalization needs to be perfect) This also repeates the "this is not a game" theme from the first 4 emails.

--- LucasMeeksSPLATaol.com ha scritto:
> What's not to trust?

Sorry? I mean, I just returned from my work trip to
Argentina and I find this and another strange mail
talking about my "colleagues" using my computer (I
don't have any colleagues, not in the usual sense, I
am freelance and I own just a laptop). I tought you
all had stopped writing me nonsense.

I never wrote you about trust.

Can you please explain the other people this is not a
game.

Lucrezia

Once again by Capitalized. This is not a game appears once more. Thought is misspelled.

Orkut stuff

In the picture there is a hidden barcode reading 0822162710052. There is also a message titled " Lucrezia: four friends weaving a 0822162710052 spiders' web. 6:18 AM 8/6/04"
The number may be a form of modular encryption. Another message in the scrapbook is by some guy named Zingus titled "Why?" She has three friends and only several groups. Odd she has three friends concidering she sent three opening e-mails.

Other theorys and stuff

Four friends: This appears a bit. May mean 4 fingers.

Shora: I doubt this is a lead.

Multiple Personalities: Capitalized and Lowercase may be multiple personalities of Lucrezia

Ame and Unknown: may these two be masquerading as Lucrezia? This is the theory I'm sticking to. Unknown escaped and has been running around with Ame. If the weird capitalization email and the Don't trust her email was the PM throttling us, then it makes perfect sense.

Both: The above two combined.

Delayed: May have her flight been delayed by rain?

[Blacklight]

Excellent summary Guest ! Thank you ! *adds the post to his evidence folder*

I agree with the fact that Shora is most likely not a lead but I'm going to check out the jpeg anyway when I get a chance. If I find nothing, I will report the spammer and get him bumped.

[Blacklight]

I just took a look at Ms. Ricci's page on Orkut and noticed that she added some photos. Now the photos have a picture of an elaborate building by a seaside taken from different angles and are lettered 1L, 1H,2E,1M,2P,2E
The letters are all in capitals.

If you take just the letters and you unscramble them, you get:
HELP ME

I wonder if she's being held against her will in this place... Maybe we can try to figure out what this place is ?

Here are the files. I put a x2 at the end of the seccond 2E file to keep it from overwriting. I wonder if the numbers for the files spell out anything. Maybe the HELP ME spells out what order the files are to be deciphered ?

[kenbo]