WARNING: Net-Integration Taken Offline!

WARNING: Net-Integration Taken Offline! Do not open any emails from N-I!

#1 Guest_Chachazz_*

Group: Non-Member - Guests

Posted 16 August 2005 - 04:25 PM

Quote

by Eagle1 @ Net-Integration:
Posted: Aug 16 2005, 07:16 PM

Net-Integration is not sending any spam but only appears to be doing so. The net-integration domain account account was disabled for the majority of the day while the source of the spamming was sought. The ISP (http://pisem.net) that is hosting malware was notified several hours ago and they have not done anything about it so far.

Let it be clarified that Net-Integration does not appear to have been hacked which seems to be a widespread comment. Logs are being reviewed to determine if source can be identified and we will keep all posted.

http://forums.net-in...showtopic=32730

***************************************************************

Apparently net-Integration website/forums have been hacked and mass emails are being sent out from the webmaster ie:

Quote

webmaster@net-integration.net
Subject: Protect Your PC !!! ( From Net-Integration Forums )
From: "Net-Integration Forums" <webmaster@net-integration.net>
Date: Tue, 16 Aug 2005 09:03:20 -0400
Protect Your PC !!!
Please download antivirus protection
antivirusprotection.pisem.net/avp.
Note: (.exe removed)

which contians Trojan-PSW.Win32.LdPinch.gen (Kaspersky on line scan)

Currently, attempting to contact N-I forums will result in "This Account Has Been Temporarily Suspended for Security Purposes"

further details when available will be posted......

Should you receive any such emails, immediately delete; do not open!

This post has been edited by Chachazz: 17 August 2005 - 01:23 AM

#2 Guest_Chachazz_*

Group: Non-Member - Guests

Posted 16 August 2005 - 05:23 PM

@TeMerc

Quote

QUOTE("erwin_mi")
Several members of net-integration forums ( »forums.net-integration.net ) received multiple identical e-mails with a link to a trojan. Just a moment after I reported this issue, the forum got hacked.

QUOTE("Magnus")
When run, this trojan copies itself to C:\Windows\csrss.exe and also drops the file C:\Windows\dll.dll. The actual trojan is a password stealer that will attempt to grab your ICQ, email account, dialup and other passwords. Any found passwords are mailed to two russian email addresses.

If an Internet connection is available, the trojan will attempt to download and execute further files from a Hungarian web site. Unfortunately these files are no longer available and so could not be analyzed.
http://www.broadband...remark,14145402

#3 Guest_Chachazz_*

Group: Non-Member - Guests

Posted 16 August 2005 - 06:30 PM

Quote

Apprantly mass emails have been sent out using N-I to do so.

These emails are not legitimate mail from net-integration.

Date 8-16-2005 prior to 11:00 AM CDT

Please do not open them! Delete them.

Eagle1 has shut down the Board and is investigating, I will post more news as I receive it.

Please understand I have a wide territory to cover and thank you for your patience.

tashi
Net-Integration Administrator.