C2MyAzz

Overview

Vendor Description

Tricks Microsoft networking clients to send their passwords as clear text. Displays usernames and their passwords as they attach to NT Server resources.

Alias

destructive program [F-Prot], Spoofer.Myazz [Kaspersky], Spoofer.Win32.Myazz [Kaspersky], Univ.OG [Panda], VTool/mya [McAfee],

Category

Password Capture: A variant of the Key Logger that captures passwords as they are entered or transmitted. Some password capture trojans impersonate the login prompt, asking the user to provide their password.

Spoofer: To spoof is to forge your identity. Attackers use spoofers to forge their IP address (IP spoofing). The most common use of spoofing today is smurf and fraggle attacks. These attacks use spoofed packets against amplifiers in order to overload the victim's connection. This is done by sending a single packet to a broadcast address with the victim as the source address. All the machines within the broadcast domain then respond back to the victim, overloading the victim's Internet connection. Since smurfing accounts for more than half the traffic on some backbones, ISPs are starting to take spoofing seriously and have started implementing measures within their routers that verify valid source addresses before passing the packets.

Origins

Date of Origin

October, 2001

Detection and Removal

Manual Removal

Follow these steps to remove C2MyAzz from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

Stop Running Processes:

Kill these running processes with Task Manager:

Remove Files:

Remove these files (if present) with Windows Explorer:

C.as-us.falkagTrackingCookie C131q C18 C2.Lop C204 C2MyAzz C308 C354 C4 C400sFTP1.0