There's couple of useful links on the right hand side of this page from the Beeb:

http://news.bbc.co.uk/1/hi/technology/6657677.stm

Also, not sure if it's been included here but if anyone wants username@username.. blackholing then you can do this by raising a ticket.

I would suggest setting up a new mailbox first and point any aliases you want to use (e.g. postmaster) at it and either assign the catch all to it (or switch it off), and just use this mailbox rather than the default address.

For Force9 customers, email addresses have the format of either [email protected] or [email protected] so if only one of these is being spammed you could switch to the other and set a rule within your mail client to delete the mails sent to the other address automatically (or put them in the bin to scan).

Same for Free-Online in that there's [email protected] and [email protected]

When was the last time you logged into webmail? If you are one of the people that received the first email we sent then we would say to do so just as a precaution, same with any mailbox passwords.

Thanks Dave.

I hope that some of the ideas regarding easier ways for people to change accounts/mailboxes talked about here and on the official forums come to fruition. As well as some of the suggestions concerning communication with customers. There's still far too much confusion about the two issues and how they effect people.

I know that not a lot in terms of details of what and how can be said now due to the seriousness of the investigations, but I hope more practical steps can be given in the short term as well as honest answers longer term.

..either on the 24th April or the 11th May but this would normally be for one of my sub mailboxes.

The email I got from PlusNet was dated the 16th May at 21.44 hours

What is the official advice based on the above info as the criteria? Bearing in mind that BOClean, Spybot & AdAware come up clean and KAV has apparently found a false positive at the point I opened a Google search page when I was searching for a program called "Loadorder" (this is the one developed by Sysinternals).

Oh, it is about time PlusNet allowed stronger passwords as they used to do & currently allow for older ones such as I have in place now for my primary and most of my mailboxes!!!! I found it a real pain when I made a mailbox change earlier this year to find my old password failed.

TIA for further guidance

>over on the official forums

Remember there is no such thing as an 'official' forum.

I collated all the relevant information yesterday and posted it on my blog. It allows all the information to be in one place and to be added to should it be needed without someone having to trawl through hundreds of posts. Hopefully I have covered the most essential bits and it can be found here: http://pn-the-truth.blogspot.com/2007/05/help-against-recent-security-problem.html

I won't have much time on my hands today but will catchup with any progress tonight.

Edited by rsharma (Thu 17-May-07 05:23:45)

Dave, was the trojan present on the system as early as 5 May? If you confirm this to be true have PN sent the first email (trojan issue) to all those that accessed the infected server?

Was the fix for the trojan changes made on the 9th or later? I ask because there was another thread in the portal that was showing similar problems on the 11th.

Hi,

Few more items to add to the software list, in case this helps:

Avira AntiVir (free version doesn't have email scanner):
http://www.free-av.com/antivirus/allinonen.html

SuperAntiSpyware (alternative to AdAware and much better)
http://www.superantispyware.com/superantispywarefreevspro.html

F-Secure BackLight (Rootkit detection: beta: expires October)
http://www.f-secure.com/blacklight/try_blacklight.html

Panda AntiRootkit:
http://research.pandasoftware.com/blogs/research/archive/2007/04/02/Panda-AntiRootkit-Released.aspx

Comodo BoClean: (anti-trojan/malware, winxp only at the moment, use with AV software)
http://www.nsclean.com/

Cheers,

Steve
http://sanesecurity.blogspot.com/

"but any sort of focussed attack unfortunately wouldn't help anyone and is very unethical."

Twould help those feeling that PN deserve all they get for not protecting us. Somewhere this company has to be taught a lesson ans lying back and rolling over does not do that.

TBF its a free world, if you want to drop to the standards and ethics you claim for plusnet feel free. To a lot of readers such an attitude and outlook would diminish the respect they may or may not have for your posts!!

Can someone from PN please answer the following questions please (they are highly important)?

In reply to:

---

Was the trojan present on the system as early as 5 May (or even earlier)? If you confirm this to be true, have PN sent the first email (trojan issue) to all those that accessed the infected server during that period?

Was the fix for the trojan changes made on the 9th or later? I ask because there was another thread in the portal that was showing similar problems on the 11th.

---