Archive for April, 2007
Tuesday, April 24th, 2007
This Trojan takes the form of a counterfeit HTML page and uses spoofing technology. It is designed to steal confidential information of users of the PayPal payment system.
Upon entering the pay system site the user enters his or her account information, which is then uploaded to the intruder, who...
Posted in Virus Threats | Comments Off
Tuesday, April 24th, 2007
This Trojan takes the form of a counterfeit HTML page and uses spoofing technology. It is designed to steal confidential information of users of the PayPal payment system.
The webpage contains an image with text and fake links:
Upon clicking the fake links, a page is loaded which imitates a...
Posted in Virus Threats | Comments Off
Thursday, April 19th, 2007
This Trojan program is designed to steal user passwords. It is a Windows PE EXE file. The file is 12,288 bytes in size. It is not packed in any way.
Installation
When launched, the Trojan copies its executable file to the Windows system directory under the original file name.
The Trojan also...
Posted in Virus Threats | Comments Off
Thursday, April 19th, 2007
This Trojan is a Windows PE EXE file. The file is 265,728 bytes in size. It is packed using UPX. The unpacked file is approximately 600KB in size.
Installation
When launched, the Trojan will copy its executable file to the following locations:
C:\Program Files\Kazaa\My Shared...
Posted in Virus Threats | Comments Off
Thursday, April 19th, 2007
This worm is a Windows PE EXE file. It is 90,304 bytes in size. It is packed using Upack. The unpacked file is approximately 237KB in size.
Installation
When launched, the worm creates the following files:
%System%\shfoxpob.dat
%System%\shfoxpob.exe
%System%\shfoxpob.dll
The worm also creates...
Posted in Virus Threats | Comments Off
Thursday, April 19th, 2007
This worm spreads via Skype. It is a Windows PE EXE file. Modifications of this program may vary in size, from 57KB to 179KB.
Installation
When launched, the worm extracts a file from its own executable file, and saves it to the Windows temporary directory:
%Temp%\sandra.jpg
This file is 74 880...
Posted in Virus Threats | Comments Off
Thursday, April 19th, 2007
This worm spreads via the Internet as an attachment to infected messages. The attachment does not contain a copy of the worm, but a component which downloads other malicious programs via the Internet.
Infected messages will be sent to all email addresses harvested from the victim machine.
The...
Posted in Virus Threats | Comments Off
Wednesday, April 18th, 2007
This Trojan is designed to steal confidential data. It is a Windows PE EXE file. It is 428,032 bytes in size. It is written in Delphi.
Installation
The Trojan also adds a link to its executable file in the system registry, ensuring that it will be launched when Windows is rebooted on the victim...
Posted in Virus Threats | Comments Off
Wednesday, April 18th, 2007
This Trojan program makes it possible for a malicious user to view network traffic with the aim of extracting passwords and other confidential data which are often transmitted in unencrypted form.
It is a Windows PE EXE file. It is written in Delphi. The file is 160,768 bytes in size. It is...
Posted in Virus Threats | Comments Off
Wednesday, April 18th, 2007
This network worm spreads via accessible network resources.
The program itself is a Windows PE EXE file. It is 67,174 bytes in size.
Installation
Once launched, the worm copies itself to the Windows root directory:
%WinDir%\Logo1_.exe
%WinDir%\uninstall\rundl132.exe
In order to ensure that it...
Posted in Virus Threats | Comments Off
Wednesday, April 18th, 2007
This Trojan downloads other malicious programs from the Internet and launches them on the victim machine. The program itself is a Windows PE EXE file. It is 8,522 bytes in size. It is written in Assembler.
This Trojan was originally mass mailed.
Posted in Virus Threats | Comments Off
Wednesday, April 18th, 2007
This malicious program is an HTML email worm. It sends itself to all email addresses in the address book. On 31st May, the worm will disable the graphical user interface on Win9x systems. It is 1,889 bytes in size. It is written in JavaScript.
Installation
When installing, the worm copies itself...
Posted in Virus Threats | Comments Off
Wednesday, April 18th, 2007
This Trojan program makes it possible for a malicious user to view network traffic with the aim of extracting passwords and other confidential data which are often transmitted in unencrypted form.
It is a Windows PE EXE file. It is written in Delphi. The file is 181,760 bytes in size. It is packed...
Posted in Virus Threats | Comments Off
Wednesday, April 18th, 2007
This Trojan is designed to steal confidential data. It is a Windows PE EXE file. It is 327,680 bytes in size. It is not packed in any way. It is written in Delphi.
Posted in Virus Threats | Comments Off
Wednesday, April 18th, 2007
This Trojan spy program harvests confidential information. It is designed to steal a range of confidential information. It harvests information entered via the keyboard and the mouse. It is a Windows PE EXE file. It is 81,408 bytes in size.
Installation
When launched, the Trojan copies its...
Posted in Virus Threats | Comments Off