ITinfo: Malicious Program Steals Passwords & URLs

Site Directory
Membership
Train-the-Trainer
Trainer Certification
Certified Training Materials
ITinfo E-zine
Responsible Training
White Papers
Trainer Resources
What's New
Speaking Engagements
Onsite Training
ITrain Gear

Password-Stealing Program

Wild things out of the net

ITinfo Sponsor

FirstGate Internet Voice-Messaging Service

FirstGate records telephone voice mail and transmits
it to any email address. All you need is a telephone.
And there are no long distance fees.
Use FirstGate's toll-free access number: 1-877-MY-VMAIL.
Sign up today for a free, 30-day trial. Whatta ya got to lose?
www.firstgate.itserv.com

Malicious Program Steals Passwords & URLs

by Dave Murphy
ISSN 1535-3613

A new email attachment is carrying a nasty trojan horse program that collects AOL usernames, passwords, and web browser history files. The data is then transmitted to an email address in China. The trojan horse program is named "picture.exe."

A trojan horse is a program that works in a way that the user does not expect it to. It differs from a virus in that it does not replicate itself.

This trojan horse, which Network Associates (McAfee) has dubbed "URLsnoop," adds a file called "note.exe" or "picture.exe" to the run line of the "win.ini" file of the Windows subdirectory. The program is then executed the next time Windows is started.

The program than does three nasty operations:

it makes a list of all .txt and .html files on the affected hard drive
collects all the URLs stored in the Internet web browser's cache
steals the username and password of the AOL program, if installed.

The collected information is then encrypted and transmitted to a Chinese email address.

Don't execute programs you receive as email attachments unless you're expecting the file and you know the sender.

I've posted a list of anti-virus points of information at dgl.com/docs/virus.html.

Have you ever been hit by a virus? What precautions do you take to prevent being hit? Leave your comments on the message center at /msg.

Anti-Virus information
Message center

Previous issues are on our website at http://itrain.org/itinfo/.

International Association of Information Technology Trainers
PMB 616
6030-M Marshalee Dr
Elkridge, MD 21075-5987

410.567.5366
1.888.290.6200
fax 801.650.0423
Membership Director: member@itrain.org

Return to ITrain Homepage

http://itrain.org/itinfo/1999/it990107.html
updated January 7, 1999