DANGER! Emails hacked...

patmos · June 16th, 2005, 1:24 AM

DO NOT OPEN ANY EMAIL ZIPs THAT YOU THINK ARE FROM SURPASS... especially from those that use your own domain name. This is a trojan designed to steal info off your hard drive.
Your virus scanner will not see it because it is custom made to target only Surpass email accounts and not a part of general virus attacks. Demand that Surpass supply you with a utility to remove the virus that has been installed on your computer and for godsake, unplug your computer from the internet until you're clean.

H · June 16th, 2005, 1:53 AM

Patmos, what makes you think someone would target Surpass, one of thousands of hosting companies? Also, how would Surpass get a removal tool for this trojan if it was crafted just to target Surpass clients? I doubt the virus writers would just hand over a removal tool.

If you can provide some conclusive evidence that it is indeed a virus just targetting Surpass and that it's undetectable, please provide it.

**removed** · June 16th, 2005, 2:53 AM

Quote:

Originally Posted by patmos

DO NOT OPEN ANY EMAIL ZIPs THAT YOU THINK ARE FROM SURPASS... especially from those that use your own domain name. This is a trojan designed to steal info off your hard drive.
Your virus scanner will not see it because it is custom made to target only Surpass email accounts and not a part of general virus attacks. Demand that Surpass supply you with a utility to remove the virus that has been installed on your computer and for godsake, unplug your computer from the internet until you're clean.

Sorry, but that's a load and a half. I'm willing to bet money that it's just this - http://securityresponse.symantec.com...ober.o@mm.html - and that your virus scanner didn't catch it because you didn't bother updating the def files.

**David** · June 16th, 2005, 2:55 AM

seems more like someone sent you one and just made it look like it came from surpass

**removed** · June 16th, 2005, 2:58 AM

That's how the virus I linked to works - lots of spoofs.

**David** · June 16th, 2005, 3:07 AM

Isn't that how most of them work? Spoofing like mad? That's how I've always understood it atleast.

**removed** · June 16th, 2005, 3:11 AM

Yeah, the point is to make it look like it came from someone you know.. or if not that, then someone important.

**David** · June 16th, 2005, 3:50 AM

I think the ones I get from Microsoft are probably valid. They put a hit out on me a couple years ago but I found out and escaped somehow.

JWalker05 · June 20th, 2005, 9:15 PM

Any updates on this?

Im getting around 10-15 emails per day because of this thing.

June 16th, 2005, 1:24 AM	#1 (permalink)
patmos Registered User Fresh Surpasser Joined in Oct 2004 5 posts Gave thanks: 0 Thanked 0 times	DANGER! Emails hacked... DO NOT OPEN ANY EMAIL ZIPs THAT YOU THINK ARE FROM SURPASS... especially from those that use your own domain name. This is a trojan designed to steal info off your hard drive. Your virus scanner will not see it because it is custom made to target only Surpass email accounts and not a part of general virus attacks. Demand that Surpass supply you with a utility to remove the virus that has been installed on your computer and for godsake, unplug your computer from the internet until you're clean.

June 16th, 2005, 2:58 AM	#5 (permalink)
removed Surpass Abuse Admin Super #1 Joined in Mar 2005 Lives in Houston, TX Hosted on NONE 7,797 posts Gave thanks: 11 Thanked 278 times	That's how the virus I linked to works - lots of spoofs. __________________ Unofficial IRC Channel: #surpass EFNet Unofficial = No official support. Support requests can be submitted to our helpdesk.

June 16th, 2005, 3:11 AM	#7 (permalink)
removed Surpass Abuse Admin Super #1 Joined in Mar 2005 Lives in Houston, TX Hosted on NONE 7,797 posts Gave thanks: 11 Thanked 278 times	Yeah, the point is to make it look like it came from someone you know.. or if not that, then someone important. __________________ Unofficial IRC Channel: #surpass EFNet Unofficial = No official support. Support requests can be submitted to our helpdesk.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

June 16th, 2005, 1:53 AM	#2 (permalink)
H after g, before i Resident. Joined in Jul 2004 Lives in N,BC,CA 8,087 posts Gave thanks: 48 Thanked 131 times	Patmos, what makes you think someone would target Surpass, one of thousands of hosting companies? Also, how would Surpass get a removal tool for this trojan if it was crafted just to target Surpass clients? I doubt the virus writers would just hand over a removal tool. If you can provide some conclusive evidence that it is indeed a virus just targetting Surpass and that it's undetectable, please provide it.

June 20th, 2005, 9:15 PM	#9 (permalink)
JWalker05 Registered User Fresh Surpasser Joined in Jul 2004 12 posts Gave thanks: 0 Thanked 0 times	Any updates on this? Im getting around 10-15 emails per day because of this thing.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)