Net-Integration Forum - bad email

Attention Net-Integration forum members!!!

"erwin_mi" wrote:Several members of net-integration forums ( »forums.net-integration.net ) received multiple identical e-mails with a link to a trojan. Just a moment after I reported this issue, the forum got hacked.

"Magnus" wrote:When run, this trojan copies itself to C:\Windows\csrss.exe and also drops the file C:\Windows\dll.dll. The actual trojan is a password stealer that will attempt to grab your ICQ, email account, dialup and other passwords. Any found passwords are mailed to two russian email addresses.

If an Internet connection is available, the trojan will attempt to download and execute further files from a Hungarian web site. Unfortunately these files are no longer available and so could not be analyzed.

All above quotes from this DSLR thread

I received 4 just like this.

From : Net-Integration Forums <[removed]>
Sent : Tuesday, August 16, 2005 8:03 AM
To : LINK REMOVED
Subject : Protect Your PC !!! ( From Net-Integration Forums )

| | Trash Can | Inbox


Received: from peace.emfc.com ([67.43.1.57]) by mc4-f37.hotmail.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 16 Aug 2005 07:07:18 -0700
Received: from eagle1 by peace.emfc.com with local (Exim 4.44)id 1E5168-0007dh-BW; Tue, 16 Aug 2005 09:03:20 -0400
Sender: <[removed]>
X-Message-Info: rbqtmZg9+AF1UA+EY2RQi5w2zpax+nsNhO4Xdn2WKL8=
X-Mailer: IPB PHP Mailer
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - peace.emfc.com
X-AntiAbuse: Original Domain - hotmail.com
X-AntiAbuse: Originator/Caller UID/GID - [32004 32009] / [47 12]
X-AntiAbuse: Sender Address Domain - peace.emfc.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php admin.php
X-Source-Dir: net-integration.net:/public_html/forums
Return-Path: REMOVED LINK
X-OriginalArrivalTime: 16 Aug 2005 14:07:19.0674 (UTC) FILETIME=[D0B65DA0:01C5A26B]
Protect Your PC !!!

Please download antivirus protection
LINK REMOVED