Vampirefo
Premium,MVM
join:2000-12-11
Huntington, WV
 ·Comcast
| reply to Link Logger
Re: Heads Up - PayPal infection attempt - New??
Ok, you have a new Trojan Dropper, very interesting one, it does a lot of things. It drops pp.gif and pp.hta in root and it runs pp.hta and asks for credit card number, Then it drops ee98af.tmp,and el388.tmp in windows folder. The el388.tmp (copies your e-mail addreses), It then drops a Trojan svchost32.exe in windows folder, then it adds itself to registry.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SvcHost32 = 'G:\WINDOWS\svchost32.exe'
It then records all your e-mail address, contacts, and any e-mail address in any of your folders inbox, sent, deleted then it try's to connect to internet and send all of this information as well as your credit card number.
Here is some pics of what it does.
--
TrojanHunter Stands For Privacy!!!!!!! |
|
Link Logger
Premium,MVM
join:2001-03-29
Calgary, AB
| Fast and good work Vampirefo as it would appear you have nailed it.
Where does it send the information too?
Blake |
|
broknsymetry
What Time Is It And Why?
Premium
join:2003-06-27
THE VOID
clubs:
| reply to Vampirefo
Almost gave me a heart attack when I viewed clipboard4.gif from your zip file. I thought McAfee was really giving me a filtering rule alert for svchost32.exe, ROFLMAO 
--
Some scientist may at last disperse
The mysteries of the universe
But me, I can not even think
Why pork is white and ham is pink
--Ogden Nash |
|
