mikeamos

I'm assuming that they are not from surpass administrators, but if they are not, I have a major security hole in my website, as the headers show the email originating from a surpass server. I receieved the following:

Subject: Account Alert
Body: We attached some important information regarding your account.
Headers: Contained an attachment called: account-details.zip containing a batch file.


Subject: *WARNING* Your e-mail account will be closed.
Body: We regret to inform you that your account has been suspended due to the violation of our site policy, more info is attached.
Headers: Contained an attachment "info-text.zip" containing a batch file..

I got two more sent with the same style.. When I first saw that a virus was attached, I expected to see something else in the headers, but it appears as if I sent it to myself, or someone got into my account and sent it to me. I understand that this probably wasn't the administration who sent this to me, but I am seeking better ways of protecting my site from and intruders, or any explanation as to how this may have occured!

Thanks!

H

What scripts are you running on your site? Have you checked various folders for any unrecognized files or even folders you don't remember putting there?

I'm pretty sure e-mail from Surpass would be going through the main Surpass Hosting server. Also, note the e-mail adresses in the "From:" part. They're "service" and "admin" at your domain. I think that gives a pretty good clue someone else is sending these e-mails.

Also remember that it could potentially be another account on your server sending the e-mails.

mikeamos

All the folders look the same.. I am the only one with an e-mail address on my account.. I'm assuming someone got my password somehow..

H

If you're running any PHP scripts like phpNuke, phpBB, etc... Something like that, they could have found an exploit to send e-mails from your server, or perhaps buried a script somewhere to do it.

You might want to e-mail support or abuse about it and have them check it out. You can do that at http://desk.surpasshosting.com/

zogger

Doesn't look like it's coming from surpass to me, unless there is some kind of forwarding at the other end? (or I'm being stupid, something could have blanked in my mind for all I know... heh)

H

Actually, that makes sense Zogger. I just checked some headers in my e-mail and it's very similar. I recieved an e-mail from buddhapuss.

Please note I removed Buddhapuss's IP.

mikeamos

ok so its an external source? that makes me feel much more comfortable

patmos

You've been hacked just like me. Fooled into opening a zip? You've installed a trojan that is downloading all your hard drive info to the perpetrator. Your virus scanner will not see it because it is custom made to target only Surpass email accounts and not a part of general virus attacks. Demand that Surpass supply you with a utility to remove the virus that has been installed on your computer and for godsake, unplug your computer from the internet until you're clean.

removed

You should really, really ASK before posting something like this and scaring people.

Chances are it's just this. I've seen hundreds of these over the last month:
http://securityresponse.symantec.com...ober.o@mm.html