Spyware Warrior

Proactive Services · Posted: Thu Mar 09, 2006 11:09 am Post subject: VB Trojan variant

Got a phishing email today pointing to a GoDaddy IP address pretending to be Windows Update. It's serving an exe which steals the contents of the Windows Protected Storage (where web site and other login details are kept) as well as taking screen shots of the Desktop and allowing remote access to the author.

The domains involved are:
dxtserver.net
dxtserver1.net
dxtserver2.net
wnplake.net
pcid.com

Few anti-virus vendors are detecting this virus yet so you should add these domains to any blocking list you have - if any of the helpers would like further details (such as the phishing site IP) etc. please contact me by PM.
_________________
Adam Piggott, Proprietor, Proactive Services (Computing)

Professional, friendly computer support in Hampshire, UK.

suzi · Posted: Thu Mar 09, 2006 1:27 pm Post subject:

Adam,

Thanks for the info. We are checking into it.

Best,

Suzi
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile

Moore · Posted: Thu Mar 09, 2006 9:02 pm Post subject:

Seems to be shut down now , great work. Cool