CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9736.22 of $21422.68
left sidedonated so farneed $11686.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
Survey
spacer
Was 2007 a good year?

Yes it was a wonderful year
Yes, but there is always room for improvement
Status quo
It was a challenge
Other (leave comment)



Results
Polls

Votes: 937
Comments: 25
block bottom
spacer spacer
image Beware!: Free Zero POPUP toolbar packs a Trojan... image
Trojans
This trojan uses "viral" marketing techniques to send an email message to all contacts found in the Windows Address Book and Eudora Address Book. This action is considered to be that of a trojan as the user does not have sufficient opportunity to agree to the End User License Agreement (EULA) displayed on the web page associated with this trojan installer. A link to the web page containing an installer for this trojan may arrive in an email message as follows:

Subject: Hi, i think you need this Body: Do you hate POPUPS ?? well i just installed this free Zero POPUP toolbar on my browser, it kills ALL popup ads and best of all it's FREE ! Download it from here http://www.zeropopup.com (its a 10 seconds download with a 56k modem) I hope you'll like it alot, it also has good rating on CNET download.com Bye :)
When a user clicks the hyperlink specified in the email message, they are taken to a web page that contains an ActiveX control. This control is loaded at startup, resulting in an immediate prompt which should warn you something is not quite right NOTE: This control is signed with an invalid signature:. If the YES button is pressed, the installer is run. The following files are extracted to disk.
- tellafriend.exe (trojan file)
- zeropopup.inf (installer setup file)
- zeropopupbar.dll (potentially unwanted application designed to prevent popup windows during browsing)

The tellafriend.exe file sends email messages to all addresses found in the Windows Address Book (WAB) and Eudora Address Book (nndbase.txt), using the default SMTP server as specified in the Internet Account Manager or OMI Account Manager. And worst of all it sends those messages to YOUR email contacts and pretends that YOU are recommending it. But that is not all, the end user agreement ( which most people don't read ) describes its other actions, which include changing the default start page, and search page of YOUR Internet Explorer.


Article source and further details: Security News Portal
Posted on Monday, 17 February 2003 @ 14:20:00 UTC by cj (2656 reads)
[ Trackback ]
image

"Beware!: Free Zero POPUP toolbar packs a Trojan..." | Login/Create an Account | 0 comments
Threshold
The comments are owned by the poster. We aren't responsible for their content.

No Comments Allowed for Anonymous, please register
 
Login
spacer
Nickname

Password

Security Code: Type Security Code: Usage signifies AUP acceptance
· New User? · Click here to create a registered account.
block bottom
Related Links
spacer
· del.icio.us!
· digg it!
· reddit!
· TrackBack (0)
· Microsoft
· HotScripts
· W3 Consortium
· C|Net News
· More about Trojans
· News by cj


Most read story about Trojans:
Newest WMF Exploit Patch Saves the Day

block bottom
Article Rating
spacer
Average Score: 5
Votes: 1


Please take a second and vote for this article:

Bad
Regular
Good
Very Good
Excellent


block bottom
Options
spacer

Printer Friendly Page  Printer Friendly Page

block bottom
spacer spacer