Emails from Website Welcome, Inc.

[GatorRichard]

It has come to our attention that some of our clients are receiving emails like this:

---------- Forwarded message ----------
From: Website Welcome Inc.
Date: Feb 13, 2007 5:56 AM
Subject: Hosting Regular Security Maintenance
To:

Dear Website Welcome Inc. valued Members

Regarding our new security regulations, as a part of our yearly maintenance
we have provided a security guard script in the attachment.

So, to secure your websites, please use the attached file and (for
UNIX/Linux Based servers) upload the file "webguard.php" in: "./public_html"
or (for Windows Based servers) in: "./wwwroot" in your site.

If you do not know how to use it, you can use the following instruction:

For Unix/Linux or Windows based websites that use PHP/CGI/PERL/ASP:
1) Download the attachment named "webguard.php"
2) Login to your site Control panel.
3) Open "File Manager" window.
4) Go through "Public_html" or "htdocs" (for UNIX/Linux Based servers), but
for Windows Based server, please Go through "wwwroot" directory.
5) Choose "Upload Files"
6) Upload the file "webguard.php"
7) Check its URL too "http://www.yoursite.com/webguard.php", if it is ok

Thank you for using our services and products. We look forward to providing
you with a unique and high quality service.

Best Regards

Website Welcome Inc.

http://www.websitewelcome.com

These emails are NOT from Hostgator. It's a base phishing attempt to get you to upload a file to your account (we all know we use Linux so "Unix/Linux or Windows" should be a big indicator that this is fake.).

What this file does is open a base64 encoded URL from within the file itself and then most likely pulls files from that site to your's (trojans or other malware).

If you receive this email, delete it immediately as it is not from us.

[PsiPro]

Well at least HG is on top of things....

http://forums.hostgator.com/showthread.php?p=46656

[GatorRichard]

Originally Posted by PsiPro

Well at least HG is on top of things....

http://forums.hostgator.com/showthread.php?p=46656

We just received notification of this today for the first time.

[nlstart]

Originally Posted by hgrfoshee

we all know we use Linux so "Unix/Linux or Windows" should be a big indicator that this is fake.

Well, yeah... ehr... duh! But in a moment of super alertness (I normally wait installing updates and stuff until the big storm is over...) I DID install the file from the attachment: webguard.php. Before I installed it I even looked in the source code but saw nothing but scrambled code.

I got suspicious and sure enough I found your post right away. I deleted it from my www root directory. Are there any other side effects I should count on? Slow performance, hijacked web site? What to expect more?

Thanks in advance for answering!
Regards,
nlstart

[GatorShashank]

If someone gets more of these mails, please be sure to email support@hostgator.com with the full headers of these mails. We need to find the origin of these mails.

Thanks.

[Serra]

Originally Posted by nlstart

Are there any other side effects I should count on? Slow performance, hijacked web site? What to expect more?

It installs software on the system, so simply deleting it will not cure the problem! It will already have done the damage. Its like stepping on a bee after it stings you... feels good, but doesn't stop the sting...

Anyone who installed this thing should contact support, just in case. Better to admit to it, than to wonder if something is wrong. (unless support says otherwise... I don't speak for them...) But anyone on MY system who installed it should contact ME...