AplusWebMaster
Topic Starter
FYI…
- http://www.symantec.com/enterprise/securit…cam_update.html
March 7, 2007 ~ "… Following further research, we are able to shed some more light on the mechanics of Trojan.Bayrob**. As stated previously*, this attack is targeted at users who will be highly likely to buy a car on eBay, (e.g. second-hand car sales companies). In this attack, victims are sent an email about a car that is being offered for sale. The email contains a legitimate slide show program that shows images of the car on offer; however, the email also contains the Trojan.Bayrob file. Below are two examples of what the slide show looks like. While the victim views the slide show, the Trojan is silently being installed in the background… The two temp files are dropped in the
'c:\documents and settings\[current user]\local settings\Temp\' folder and are named kvet*.exe. One file is the clean slide show application, and the other is the Trojan."
* http://www.symantec.com/enterprise/securit…otors_scam.html
** http://www.symantec.com/enterprise/securit…-030115-1234-99
- http://www.symantec.com/enterprise/securit…cam_update.html
March 7, 2007 ~ "… Following further research, we are able to shed some more light on the mechanics of Trojan.Bayrob**. As stated previously*, this attack is targeted at users who will be highly likely to buy a car on eBay, (e.g. second-hand car sales companies). In this attack, victims are sent an email about a car that is being offered for sale. The email contains a legitimate slide show program that shows images of the car on offer; however, the email also contains the Trojan.Bayrob file. Below are two examples of what the slide show looks like. While the victim views the slide show, the Trojan is silently being installed in the background… The two temp files are dropped in the
'c:\documents and settings\[current user]\local settings\Temp\' folder and are named kvet*.exe. One file is the clean slide show application, and the other is the Trojan."
* http://www.symantec.com/enterprise/securit…otors_scam.html
** http://www.symantec.com/enterprise/securit…-030115-1234-99