Shoutbox

[Quote=Messenger Plus! Zone]
http://www.msgpluszone.com/
SECURITY ALERT!
A new trojan is circulating as a Messenger Plus! Plugin, Full details below.

Report: On 6/11/04 at around 6:30PM Eastern Standard Time, Messenger Plus! Zone obtained a copy of a file ("SWMPplugin.exe") that is known as Backdoor.Prorat (Symantec). The trojan was circulated as a Messenger Plus! Plugin that add's new sounds, and after receiving this file it was processed and scanned and it is a dangerous backdoor. The Trojan can allow a hacker to gain complete control of your computer.  The trojan HAS been reported to Patchou.

---

Just look out for this trojan and remember it may be renamed under a different name.

what did it say this plugin did, and was it posteed here on these forums?

hmmmmmmmmmmmm could this be more childish behavior from dane????

quote:

---

Originally posted by TheBlasphemer

quote:

---

Originally posted by jackass_wanabe
hmmmmmmmmmmmm could this be more childish behavior from dane????

---

I had the same idea...
If symantec recognized it, it has been around for a while.
There is no possibility of modifying an existing trojan and turning it into a Plus! plugin...

---

Well...
You could put the trojan as resource inside the plugin and then on the initialize funtion, extract the trojan from the resource and then run it...

I think DJM meant "to modify a trojan's executable file".

Well, I agree with DJM in this aspect, it's nearly impossible to modify an executable file and add such function entries in it.

According to Neowin news post/comments, the file is not a Plus! plugin at all - it's just being claimed to be a Plus! plugin.

quote:

---

Originally posted by Mnjul
Well, I agree with DJM in this aspect, it's nearly impossible to modify an executable file and add such function entries in it.

---

if you can code a little that's not hard at all. well at least you don't "modify" it, but you create a copy of it, but with a file included. never heard of EXE binders ?

Yeap, just bind a valid setup EXE with the trojan executable, and voila! Haha, you have your plugin working perfectly with a the trojan silently!

I was shocked to hear that a deadly trojan was circulating a messenger plus plugin. Will those hackers ever stop playing hell with us all.

I found this link which shows a screenshot of the client side of the deadly trojan (the part the hacker uses to cause havoc). Looks to me like the hacker can do some pretty evil stuff to your PC behind your back.

http://www.megasecurity.org/trojans/p/prorat/Prorat1.8.html

and No, you can't download the trojan off the site, it's a screenshot only.

Makes you think really how sad hackers really are, don't ya think...

I used to do stuff like that a few years ago.. With friends though... Then I would like give them popups with 'Why hello there', or start a Matrix chatscreen... It was funny. I got a warning from my ISP, so I  had to stop, it was fun playing around with mates... as long as you don't break anything... They knew about it though, so it was different...
But is it or is it not a MsgPlus plugin?

it's NOT a msgplus plugin. if it was, you'd see it directly (in the plugin menu).