AIM.VB.A

Overview

Vendor Description

From the doc: ' This program is very easy to use and has several ways to recover the entered password, plus it looks and acts exactly like the real McCoy! 1. If you want to recover the password by means of ICQ Pager, you must first execute the program 'decrypter' included in this package. Set a new ICQ number where it tells you to. Note: This only works if it is used on the same computer it is set on since it puts the ICQ number in the registry. Password 'fakeaim' 2. It automatically puts the username and pass *encrypted* into the registry, just waiting for retrival later. It only records the last put in password. 3. If you havnt already noticed, it looks pretty much exactly like the real thing, with all the mouse over Subs, plus, once someone tryes to login it shell executes the actual AIM program, and if it cant be found, it gives a connection error. 4. type in the name space 'tell me about' and in the password feild 'fake aim' to learn the vertion and info about it. Im board, so here is a list of functions Registry editing Encryption Advanced PW Recovery ICQ Notification System Tray Icon sys tray Menus - exatly like AIM Shell execution of real AIM mouse over affects convincing icons'

Alias

Real McCoy AIM Password Stealer, Trj/AOLPS.Egrof [Panda], Trojan Horse [Panda], Trojan.PSW.AIM.VB.a [Kaspersky], Win32/AIM.VB.a!PWS!Trojan [Computer Associates], Win32/AOLPS.Egrof!Trojan [Computer Associates], Win32/PSW.AIM.VB.A trojan [Eset],

Category

Password Capture: A variant of the Key Logger that captures passwords as they are entered or transmitted. Some password capture trojans impersonate the login prompt, asking the user to provide their password.

Trojan: Any program with a hidden intent. Trojans are one of the leading causes of breaking into machines. If you pull down a program from a chat room, new group, or even from unsolicited e-mail, then the program is likely trojaned with some subversive purpose. The word Trojan can be used as a verb: To trojan a program is to add subversive functionality to an existing program. For example, a trojaned login program might be programmed to accept a certain password for any user's account that the hacker can use to log back into the system at any time. Rootkits often contain a suite of such trojaned programs.

Origins

Author

R3L4x34

Date of Origin

February, 2003

Detection and Removal

Manual Removal

Follow these steps to remove AIM.VB.A from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

Stop Running Processes:

Kill these running processes with Task Manager:

Remove Files:

Remove these files (if present) with Windows Explorer:

AGuidetoInternetSecurityBecominganUebercracker... AHCTrojan AHGEZshopperLoadpage.cgiFileListDisclosureVulnerability AHS AIDSInformationTrojan AIM.VB.A AIM1.87 AIM3K AIMAbomination2 AIMEvilDoer