Woohu.com - Read Comments

Add Memory \| Add To Friends
	pjlmaster (profile) wrote, on 10-27-2005 at 8:17pm

DO NOT GO TO THE EDEN website it has once again been hi-jacked and now there are viruses on it and god knows what else Win32:Prorat-C [Trj] is what its called and it will ask you to download yahoo messenger beta.exe OBVIOUSLY that is just bullshit just dont go there people edit: Virus info ; Win32.Prorat.C is a backdoor trojan that allows unauthorized access to, and control of a victim's machine. It is UPX-packed and its code contains comments that appear to be in Turkish. Method of Installation When executed, Prorat.C copies itself to %Windows%\winlogon.exe and %Windows%\system32\fservice.exe. On Windows 2000 and XP systems it also copies itself to %Windows%\system\sservice.exe and drops two DLL files: winINV.DLL and Winkey.Dll in %Windows%\system32\. Note: '%Windows%' is a variable location. The trojan determines the location of the current Windows folder by querying the operating system. The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; for 95,98 and ME is C:\Windows; and for XP is C:\Windows. All of the dropped files have their attributes changed to hidden and system, in an attempt to make the files harder to find. Payload Backdoor Functionality Prorat opens up two FTP servers and a backdoor for the Prorat Client to connect to. For more information on backdoors and remote access trojans, please visit the Virus Information and Prevention section in our Virus Information Center.
Post A Comment