|
| Name: | Moscow Email trojan |
| Aliases: | Platan, Asp, Win32/Platan.Trojan, Platan.G, IExpand Trojan, DUNpws.bz, |
| Ports: | 25 (port can not be changed) |
| Files: | Moscow1.2.zip - 113,551 bytes Moscow1.2.zip - 113,896 bytes Moscowv1_3.zip - 161,086 bytes Moscow1.3.zip - 161,601 bytes Moscowv1_4.zip - 134,770 bytes Moscowv1.4.zip - 135,107 bytes Moscowv1.4b.zip - 136,859 bytes Moscow1.5.zip - 137,070 bytes Moscow1.6final.zip - 163,354 bytes One.zip - 81,009 bytes Two.zip - 80,045 bytes Asmphoto1.exe - 33,280 bytes Tconf for asmphoto1.exe - 50,772 bytes Asmphoto2.exe - 30,720 bytes Tconf for asmphoto2.exe - 50,772 bytes Tconf.exe - 55,808 bytes Tconf.exe - 315,392 bytes Config.exe - 38,401 bytes Tconfig.exe - 315,392 bytes Configurator.exe - 187,392 bytes Edialer.ini - New_script.scp - Newicon1.exe - 38,400 bytes Newicon2.exe - 38,401 bytes Photo_1.jpg.exe - Photo1.exe - 38,401 bytes Photo_1.jpg.exe - Photo2.exe - 38,400 bytes Icon_1.exe - 39,424 bytes Icon_2.exe - 39,425 bytes Iexpand.exe - 38,401 bytes |
| Created: | Mar 2000 |
| Requires: | N/A |
| Actions: | Mail trojan / Autodialer / ICQ trojan / Steals passwords |
| | It deletes the two system files Regedit.exe and Msconfig.exe. |
| Versions: | 1.2, 1.3, 1.4, 1.5, 1.6 (final). |
| Registers: | HLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ |
| Notes: | Works on Windows 95 and 98, together with ICQ 99a. |
| Country: | written in Russia |
| Program: | Written in Visual C++ 6. |
 Using the Process Monitor from AATools, you will see whether any foreign
programs are running on your computer. If you find some unwanted program, you
can terminate it by clicking the 'Terminate Process' button on the Toolbar.
Using the AATools Network Monitor, you can see what ports are in use on
your local PC for connection with remote systems (LAN/Internet). On Windows
NT/2000/XP the Network Monitor will display you the services that are active on
the ports, and map the ports to their respective applications. If you register
port probes directed against ports that are normally not used, it is possible
that someone is trying to connect to a Trojan inside your network. Using the
Registry Cleaner (Startup section) from AATools, you will see
the list of programs that are registered under Run, RunOnce, RunOnceEx and
RunService registry keys. So you can find out what programs are started behind
your back. You should check these programs to see they are legitimate ones but
not Trojans programs.
0-C | D-H | I-N
| O-S | T-Z
If you have any questions or information about ports used by Trojans not
listed above, please contact us. |
