Thread: *Trojan Horse!!
View Single Post
  #1 (permalink)  
Old February 25th, 2001
ChronKyrios ChronKyrios is offline
Novicius
 
Join Date: February 25th, 2001
Location: Pick, One USA
Posts: 3
ChronKyrios is flying high
Exclamation *Trojan Horse!!

I have been using bearShare for a shortperiod of time. I have found that MANY of my searches come up with an EXACT MATCH (with an EXE tacked on the end), though I am using only keywords. This follows even with searches like "dhvsbgjjk sdagbb".
Generally, the file size of the match is 8192 bytes, but has varied.
There is some consistency in the ip addresses that return it.
I downloaded one of them (incidentally), and ran it. It seemed to do nothing. Then my firewall started warning me of outbound connection requests. I denied it, removed it rebooted.
When I came back, I found a similar program with a different name in my startup menu. I removed that as well.

Could not determine the nature of the program except that it wanted to connect to seemingly random ip addresses.
The programs passed a virus check, and no reference was found on the internet.
Oh the only other consistency seemed to be they were all listed on port 99 in the search results column

This is a warning as well as a question. The question is, has anyone seen this, or know anything about it. Any information would be helpful.
Reply With Quote