Some messages from Interwebs Promotions contain an offer such as “Download more RAM”. These are fictional offers inside Terminal Rebels. Opening one can start a disguised miner or vSpam installation on your game server. Nothing is installed on your real computer.
Reading is safe, offers need care
Reading the message or showing its header does not start an installation. Opening an offer does. Offers expire after 24 hours and can only be used once. A cancelled attempt cannot be restarted with the same offer. Only one mail installation can run on your server at a time.
Accounts must have a confirmed email address and have completed Hacking 101 before they can receive infectious offers. Beginners can still receive ordinary spam.
Stop a suspicious installation
The offer appears in Task manager while it installs. It takes time and needs free disk space and RAM. Cancel the task, or open Connections and disconnect the sending server. Disconnecting also cancels other tasks that need that connection. Closing Mail or logging out does not cancel the installation.
An antivirus scan can remove a pending infection if its version is strong enough. Sentinel can detect and interrupt it when running with antivirus protection; lockdown slows it down. Detection is not guaranteed. Check your alarms, local log and installed files.
Show the mail header to see the sending server's IP. The sending server may itself be infected; its IP does not identify the virus owner. Following an offer does not grant you a login to that server.
Your vSpam offers
An active vSpam installation can send offers using the original virus owner's local miner and vSpam installers. Under Settings → Viruses & spam, choose:
- Mixed: equal chances for miner and vSpam when both are available.
- Prefer miner: uses a miner when available, otherwise vSpam.
- Prefer vSpam: uses vSpam when available, otherwise a miner.
The strongest available version of the selected type is used. Hidden files, external disks and running foreign infections do not supply installers. Without a suitable installer, messages remain ordinary spam. Moving or renaming an installer is fine; removing it or changing its version makes outstanding offers unusable. Changing your preference affects newly sent offers.
Ownership and income
A successful infection reports the victim's game IP to the original owner and appears with their other active viruses. Passwords are not disclosed. Other virus types already on that server stay active.
Miner income follows the normal Bitcoin mining rules; vSpam follows the normal spam rules. If the new vSpam sends another infectious offer, the original owner still receives the resulting income. The newly infected player does not become the owner.
The new infection keeps the same control server as the sending vSpam. Emergency shutdown and vacation mode have the usual consequences for that server's external income viruses.
See also: Mail, Security Center.
SpamShield: Mailbox filtering against unwanted messages and spam offers.