Virus from Surefire.com?

[Greymage]

I've been getting NetSky viruses, most addressed to me at:

[email protected]

where mydomain is my domain. Has anyone else seen these? The reason I think Surefire.com is the infection point is that I use site-specific emails when I buy things online, so I would only have used the surefire address at Surefire.com

 

[Size15's]

Have you informed SureFire's Webmaster?

 

[Greymage]

[ QUOTE ]
Size15s said:
Have you informed SureFire's Webmaster?

[/ QUOTE ]

Yes, I just did... the address is sandiegomedia, so I guess they don't have an in-house webmaster.

 

[Greymage]

The specific virus is W32.Netsky.D@mm, according to Yahoo's Norton Antivirus scanner.

 

[juancho]

Also is another kind of virus in Surefire Website, for every time I go there I get infected and buy another light!!!

Juan C.

 

[jayflash]

Good one, Juan. lol

 

[Greymage]

No response from webmaster and still getting viruses.

It might not be surefire itself, might be someone they sold their email list to, or someone who stole their email list.

Still, would be nice to get a response.

No one else is getting viruses directed to an email they used when buying stuff from or contacting Surefire?

--- [email protected] wrote:

> From: [email protected]
> To: [email protected]
> Subject: Re: Re: Re: Your document
> Date: Thu, 12 Aug 2004 07:43:42 -0700
>
> See the attached file for details.
>

> ATTACHMENT part 2 application/octet-stream name=document_4351.pif

 

[KevinL]

Netsky tends to forge email addresses, so it could have stolen the surefire.com addresses from someone's address book along the way, and then sent you an email with the forged headers.

Kinda like you sending person A an envelope with Person B's return address on it, instead of your real return address. A now thinks B did the dirty deed..

 

[gadget_lover]

I think greymage said that he set up a specific mail address to use with surefire, so it's known only to surefire. It's most likely that a computer at surefire is infected. The infected system also has the address [email protected] in it's
files somewhere, as that's the one that was spoofed.

Netsky is still accounting for about 50% of the viruses that I see at client sites. I trap about 100 a day going to a company of less than 500 people.

Daniel

 

[Greymage]

[ QUOTE ]
KevinL said:
Netsky tends to forge email addresses, so it could have stolen the surefire.com addresses from someone's address book along the way, and then sent you an email with the forged headers.

[/ QUOTE ]
Yes, the source address for the emails is always different. Actually it looks like it picks someone else's email address to use as a source.

But it's the destination address that makes me think Surefire is infected, I only used that one email address with Surefire.

 

[Size15's]

Okay, you should contact SureFire direct. I believe that Derek McDonald is the one to contact.

 

[Greymage]

Thanks, I sent an email with an Attn: Derek McDonald to their customer support email, hopefully they'll respond to that one.

 

[Greymage]

No response from Surefire yet... got another virus today:

--- [email protected] wrote:

> From: [email protected]
> To: [email protected]
> Subject: Re: Your website
> Date: Fri, 13 Aug 2004 07:35:48 -0700
>
> Please have a look at the attached file.
>

> ATTACHMENT part 2 application/octet-stream name=your_website.pif

 

[Greymage]

Here's today's virus... still no response from the Surefire customer service email.


--- [email protected] wrote:

> From: [email protected]
> To: [email protected]
> Subject: Re: Your document
> Date: Mon, 16 Aug 2004 07:50:01 -0700
>
> Here is the file.
>

> ATTACHMENT part 2 application/octet-stream name=your_document.pif