I got this in my e-mail.

[IceHawk]

Hello Graal2001 and GraalClassic players this message
is very important as myself and Stefan Knorr have
found a very dangerous secureity hole in most Graal2001
clients, hackers could and already have exploited
this secureity hole and has stolen some accounts,
Stefan has coded a patch to secure this hole, it can
be download at http://www20.brinkster.com/graalonli...l2001patch.zip
we are doing every thing we can to get FTP and Account
functions back, this patch will secure your graal clients
until Stefan releases the next version of Graal2001,
we will find out who has been doing this and take legal
action against these hackers.
-Stephane Portha.

I believe this is fake, I e-mailed it to Stefan and Unixmad
but I don't know
It came from [email protected].

Hmm...
that seems definetly fake.
the sender probably the owner of www20.brinkster.com/graalonline whoever that is..

[TylerS36]

wow, I didnt know Unixmad's english has improved so much since I last seen him speak.

[omni-m00gle]

Probably used a mail manipulator or some tinker. Wouldnt trust them..

[Lycia]

Hmmmm, that e-mail sounds awfully familiar.

I got mail bombed with about 100 messages the other day from that same e-mail.

[Valder]

i think the sender is trying to get the accounts by sending the message to ppl...

[grim_squeaker_x]

That isn't Unixmad I'm extremely sure about that because he would have just posted it io the graal2001 site if this was the case and would then have just ordered us to re-run the setup.exe.
And as someone else said, it uses too good grammar in it (No offence meant to Unixmad of course )

[Pago]

All you have to do is catch Unixmad in the streets and ask him to spell "security"... heh

[FatherDante]

He also would have put the accent in his name.

[IceHawk]

Except that I'm a ***** and I ran the program accidently.

[StoneColdRichie]

Originally posted by IceHawk
Except that I'm a ***** and I ran the program accidently.

Hey GUY why are you home from school? DID YOU CUT YOU CUTTER?

[IceHawk]

AND I was on a crack website, and on the request list was Graal 2001, and these people were hackers so maybe the hackers are from the "Ebola Virus Crew"

[activeconvict]

If you guys are looking for grammar problems, IM AudioSonyX (AIM/AOL)

[G_yoshi]

what happend when you ran the program?

[Cyboars]

Probally didn't look like it ran and stole his stuff and starting to delete his HD, its basicly the same as the program at:

http://graalcheat2001.homestead.com/

then again i COULD be wrong..

[omni-m00gle]

Still wouldnt trust someone that works for graal that knew that much english. No offense..

[sniperjoe10]

I wouldn't trust it, if I were you ..

[IceHawk]

Absolutely nothing happened when i ran the program.

It probably did something that allowed access to your PC.
I opened a fake gserver by accident once, nothing happend but the next day i was MATRIXHAXORRED.

[FatherDante]

I've had 1 virus before, it was a nasty little bugger. I was proud of myself for sweeping it out by myself after about half an hour, but in retrospect, it's kind of stupid, a good virus scan would have gotten rid of it in seconds. Oh well.

[Valder]

hmmm......i don't really recommend opening it though

Originally posted by IceHawk
Absolutely nothing happened when i ran the program.

h0h0 you are screwed.
Most likely sub7, they just renamed server.exe (the virus) to a different name and made it a different icon.
Go to start>run>win.ini
see if there is anything after "load=" or "run=".
Heh, it is fun to sub7 yourself and play around with the features. You just have to remember to hit the remove button when you're done playing around.

[juztin890]

It contains a trojan.

----------------
Date: 18/04/01, Time: 00:10:48, Default
The file GraalCheat2001.exe in the compressed file
CPERSONAL\Justin\Graal\TEST\Graal2001patch.zip
is infected with the Trojan Horse virus.
----------------


dats what meh virus checker said.

[Immitat0r]

Probably a server for your comp so they can access it, another reason Unixmad does not speak that good english(seriously), and also if they made something like that he would probably post it on the main g2k1 webpage, because he just wouldnt e-mail people to download it.

[juztin890]

I doubt it was a server tho... i mean it coulda been but like my firewall never came up with the usual things: asking if the program can be allowed a pass to the net.
I know it sounds stupid virus software needing permission to access the net but like they all do for me... well, sub seven did when i had it and lodza other *** viruses i have contracted in the past =/

[Immitat0r]

Thats what I am saying, probably a sub7 server, I have got so many people who think I am dumb to go over and download a gif file thats 400kb and zipped, I would never be that stupid but apperenlty now they can get as small as 50k, so its more harder to tell.

[IceHawk]

Good thing i downloaded a couple of firewalls

[IceHawk]

Does the "remove" button work for other servers on your computer?

an image file isn't an executable...it can't contain a virus.
Ohhh you mean the zip. Nevermind. =/

[Immitat0r]

Now they can hide servers in Mp3s, just to warn people, someone fooled me the other day with it, and noticed they where trying to get my icq password and deleted it. So if anyones like "Download a Mp3 file!" I would rather you not do that and rather go on napster or search it somewhere.

[galen]

Trojan.Win32.Munga

[Lycia]

My virus detector picked up no viruses from those mailbomb messages I got.

Maybe its a randomizer.

[grim_squeaker_x]

I extracted something from the source of that actual E-Mail:

X-Sieve: cmu-sieve 2.0
Return-Path: <[email protected]>
Received: from server0010.freedom2surf.net (server0010.freedom2surf.net [194.106.56.10])
by server0034.freedom2surf.net (8.9.3/8.9.3/Debian 8.9.3-21) with ESMTP id XAA16109
for <[email protected]>; Mon, 16 Apr 2001 23:20:40 GMT
From: [email protected]
Received: from scaup.mail.pas.earthlink.net (scaup.mail.pas.earthlink.net [207.217.121.49])
by server0010.freedom2surf.net (8.9.3/8.9.3/Debian/GNU/f2s) with ESMTP id XAA05963
for <[email protected]>; Mon, 16 Apr 2001 23:20:38 GMT
Received: from mail.graal2001.com (evrtwa1-ar1-252-228.elnk.dsl.gtei.net [4.34.252.228])
by scaup.mail.pas.earthlink.net (EL-8_9_3_3/8.9.3) with SMTP id QAA01983
for <[email protected]>; Mon, 16 Apr 2001 16:20:38 -0700 (PDT)
Date: Mon, 16 Apr 2001 16:20:38 -0700 (PDT)
Message-Id: <[email protected] t>
To: [email protected]
Subject: Critical Security holes found in Graal2001 clients, Download Patch update to keep your accounts secure.

If yo pay good attention to the above stuff you will notice the:
"From: [email protected]
Received: from scaup.mail.pas.earthlink.net (scaup.mail.pas.earthlink.net [207.217.121.49])"
Which means that it actually was sent using earthlink.net, and that "scaup.mail.pas.earthlink.net [207.217.121.49]" is in it several times.

[zwr]

it's Hard Drive Killer Pro 5.0 Beta

[IceHawk]

Harddrive killer?!

[Cyboars]

Yeah...downloads your Hard Drive and then deletes it from your computer...be careful if you turn your computer on and theres an image on your desktop talking about sending or receiving....

[zwr]

according to the official site of that thing it formats all your hd's in 2 seconds.