Feeds

Trojan serves porn off home PCs, not many dead

AOLers chief victims

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

A new Trojan is turning Windows PCs into porn and spam relays, possibly as a means of harvesting credit card details, researcher Richard M. Smith has discovered.

At first it was suspected that the Trojan installs a Web server on the victim's machine from which the porn is served, but research by LURHQ indicates that it sets up a proxy which forwards the porn and x-rated spam and so keeps the originating server hidden.

Machines hosting the Trojan are not harmed in any way, but spam recipients who check out the porn on offer may become victims of fraud if they sign up for access using their credit cards.

The overall purpose appears to be establishing a semi-anonymous, distributed hosting scheme for malicious sites or for material that might invite retaliation from a Web host or the authorities, such as warez or child porn.

Only about two thousand home machines have been infected, but among them is a high proportion of AOL subscribers, implying that it may be spread via instant messaging. According to LURHQ it is easy to detect and defeat.

First, remove this registry key:

Software\Microsoft\Windows\CurrentVersion\Run\Login Service = wingate.exe

Then reboot the computer and remove this file:

%windir%\system32\wingate.exe.

The spam ads direct users to Russian porn sites chiefly, sometimes using servers that were involved in a recent Paypal scam, Smith notes. ®

Related Stories

Rise of the Spam Zombies
Trojan defence clears man of child porn charges
What's the difference between a viral attack and a scan?
Windows Root kits a stealthy threat
Mindjail worms way through IRC
Fizzer stealth worm spreads via KaZaA

Beginner's guide to SSL certificates

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.