PDA

View Full Version : "game password" stealing trojan?


Ledsr40
April 1st, 2007, 09:48 PM
First I'll start by saying that I think gamespot is hacked or something because I got a virus reported by Outpost when browsing the site.

I got a popup from Outpost with some spyware trojan called OnLineGames.
I deleted it and scanned the computer with nod. Then nod popped up three instances of viruses two in jpg images with a virus called

TrjoanDownloader.Ani.Gen

Then there is a executable with the virus

Agent.NCC trojan

According to Eset, http://www.eset.eu/buxus/generate_page.php?page_id=15567
It's for stealing passwords for the game Zhengtu (which I have never heard of).

All three are some "possible variant of" of the above viruses. And they are all in the temporary internet folder.

My first question is asking for someone to explain to me what those viruses are and what they do.

And the second question is whenever there is some virus coming from the internet and supposedly blocked they always end up in the temp internet folder. Shouldn't the security programs block it from entering the computer? Why are they all saved on my computer when they should have been blocked?

Thanks in advance.:)

planet
April 1st, 2007, 10:57 PM
You might want to read through this thread at DSL reports security forum:
http://www.dslreports.com/forum/remark,18085278

Ledsr40
April 1st, 2007, 11:27 PM
I have rescanned my computer with nod with all of the hurestics on and it reports clean. So what should I do now? Or in other words how serious is this thing and what kind of situation I'm in here and what other steps should I take?

ASpace
April 2nd, 2007, 03:27 AM
-{ Quote: "I have rescanned my computer with nod with all of the hurestics on and it reports clean. So what should I do now?" }-

Nothing special . Just make sure your NOD32 uses the latest protections (currently 2161 and v 2.7).Everything else is ESET job :thumb:


By the way , you can read these two about Ani.Gen:
http://www.wilderssecurity.com/showthread.php?t=170165
http://www.microsoft.com/technet/security/advisory/935423.mspx