Magic PS Trojan Infection

Hi everyone, Tammy here.
Naive newbie

Chatting on Yahoo, met a fried (who turned out not to be such a great friend), anyhow, he sent me a file infected with a trojan virus.

The program he used is called Magic Pass, or Magic PS

Everytime I login to Messenger, it sends him a PM with my ID & password.
It is my undertsanding that it has also dropped in a keylogger
In addition, it has disabled regedit.
Everytime I turn my computer on it gives me an "error code #5", a feature of Magic PS

I found the website for Magic PS,and they brag that it is undetectable by most AV's. I removed the original file, but the registry has already been changed, and of course, I can not edit it. Re-installed messenger, doesn't matter

A plea to this guy only resulted in a "format your hard drive" response.

Am I out of luck for a viable solution besides formatting my drive? Any help would be appreciated.

By the way, I am fully aware of the stupidity, thought he was trustworthy.

Thanks gang, have a great day.

Tammy,

Here is the information about it's function. From the same site download Pest Patrol and install it. You may need to start up in safe mode for the complete removal.

And let's not even trust your granny out there in future..... ;)

Good luck

[edit]

Oh, two more things:-

1. Change your user ID if you can bit definitely change your password. Make it complex using uppercase, lower case letters, numbers and special characters, for example t4mmY26$ - do this _after_ you clean the infection and have scanned a second time.

2. Send him a pm pointing out that no matter how l33t he thinks he is conning people into installing trojans is utterly LAME.....

[/edit]

Thanks for the quick reply!

On my way, and I'll let you know.

Cross your fingers

< In response to your edit, I agree, very lame, now he's a booter, and exclaims so with pride, I just don't know sometimes.

<Will definitley change the password and possibly ID after fixing this problem.

;) Glad you were up, couldn't sleep this was bugging me

Oh Dear,

http://www.usdoj.gov/criminal/cybercrime/reporting.htm

I think it is self explanatory.......remember to fill out the form 4017(US Secret Service) as well as the FBI one ;)

You must know his ISP (Internet Service Provider) so if you e-mail "abuse@ his ISP" that might cause some fun............but do let the Feds and the USSS have first shot :)

There are NO prisoners in this game, anyone who does that is an a$$hole and needs to be taken out.

Reminds me of:

"To err is human..............
To forgive, devine............
NEITHER are Marine Corps policy"

The problem, IMHO, is not getting rid of the crap on your machine...............it is getting rid of the crap that put it there?

Quote:

---

In addition, it has disabled regedit

---

A deliberate damage to the functionality of your machine?............CRIMINAL OFFENCE????

Go for it :D

I think I love you guys :)

Tammy:

Quote:

---

I think I love you guys

---

Let's not get carried away..... You're talking to two of the oldest and smelliest members of these forums..... ;)

Tiger!


What do you mean "smelliest".................you know I always take a shower when it is raining?

:D

lol you nasty old farts....Its ok Tammy, i'm 20, handsome, sensitive, sensible, adorable, generous, sincere and honest.

the real question cybr1d is are you single and ... err... straight (just asking for the ladies folks, no offense intended) ;p~



just to be sure that I don't offend unintentionally I'll list this as hidden

lol :D, unfortunately for Tammy i'm taken and yes i'm straight.

Done! Seems to have worked!

Thanks guys, glad I found you. Love was a strong word, but you guys are my new favs :)

I'll definitely be back, just not for the same problem, I promise you that.

Quote:

---

lol you nasty old farts....Its ok Tammy, i'm 20, handsome, sensitive, sensible, adorable, generous, sincere and honest.

---

I have no doubt you all are.

Have a fantastic day!

:D :p

Glad to be of service Ma'am

PS: I'm by far the most attractive chap in the forum..... Don't listen to the young whipper-snappers - they still use their pocket protectors...... Of course, mine wore out over the years....<LOL>

I'll see your pocket protector and raise you a slide rule :D

Lv4: Wooden or Plastic?

well it depends Tiger Shark.

If we are talking about a Mannheim slide rule then it's wooden, but if it's a Keuffel & Esser then all I have ever had was a plastic one.

My dad used to have one that was metal though, if that counts.


oh oh oh, I forgot ALL about my old e6-b flight computer which had a circular slide rule :D

A flight computer..... I had one too.... Had a slide-rule too.... can't remember what the hell it was.... Old age is a Bitch.... <s>

What did you fly? <just to go really off topic>

I was Puma helicopters in the RAF.

heh, old age is indeed a bitch, I honestly would forget my name somedays if I didn't have to wear a picture id ;)

well I never flew military even though I wanted to. I was only enlisted for the US Navy and that was before I was flying... anyway, I can fly just about anything from a Cessna 152 on up although I haven't been flying in a few years as I just don't have the time for the hobby any more. After I got out of the Navy I thought I would try my hand a commercial aviation but then I refound my love for computers (ugh it's really a love/hate relationship) and aviation became just a hobby for me.

Wow, all you have to mention is that your female and not only do you get a quick response, but everyone and there brother tries to pick you up.

Guys,

Quick Question...

How many times have we found out the members claiming to be female are really male? That was the first AP con when girls were getting bombarded with AP's for being chicks.
:rolleyes:

(for the record)

I'm not saying Tammie is not a chick (note gender is unspecified in profile), my comment was in response to how the last few posts were more related to her being female rather than the problem...

Im dead sexy ;)

Hey gang!

Thanks again for all your help, seems to have done the trick.

Quote:

---

Wow, all you have to mention is that your female and not only do you get a quick response, but everyone and there brother tries to pick you up.

---

For the record, I never mentioned that I was female in my first post. I am, but I am hideously ugly, with the personality of a dead fish. :D

Have a smashing great day everyone!

Quote:

---

That was the first AP con when girls were getting bombarded with AP's for being chicks.

---

Now please excuse me while i try and find out what AP's are :(

Heh AP are antipoints...

quote:
What are these Antipoint things? Here's a lil read i searched up for ya real quick. Found it in a response from wolverine telling someone else what antipoints are. Heh, and they are right about the female thing.


Antipoints are a way of recognition in AO. You acquire antipoints by posting good meaningful posts that help somebody. You can get both positive (green) antipoints, or negative (red) antipoints. If you recieve to many red antipoints your account may be removed.


Why do I have a message saying I'm going to be banned?


You have acquired to many negative antipoints and this is your warning. You still have a chance to redeem yourself though. Just stop posting meaningless one-liner messages like "I agree", or "Good post!" and stop asking how to hack stuff.

------------------------------------------------------------------------------------------------------------------------

AntiPoints Explained by allenb1963


Q: Once I'm able to assign AntiPoints, how do I do it?

A: Each post has an "Assign Positive or Negative AntiPoints to This Post" link located in the upper left corner of the post which opens an assignment box. AntiPoints of a positive nature should only be assigned to posts that are worthy in that they provide a correct answer to a question, provide useful and relavent information, or make a valid point that you STRONGLY agree with. Negative AntiPoints are used for posts that provide misleading information, request information that can be used for illegal purposes, are derogatory or insulting in nature, or make a point that you STRONGLY disagree with.

As you rise through the ranks of AO and increase your number of AntiPoints, the impact of your assignments increases as well. As that influence grows, so should the sense of responsibility you use to assign those points. Forming alliances in order to enhance your position or defile someone else's AP status is a practice that is frowned upon and dealt with severely when discovered. You are strongly urged to avoid such behaviour.

When you assign points, you will notice an area where you are allowed to put in comments. Please attempt to use this area in a constructive manner and refrain from name calling and profanity. There will be cases where you may receive comments of this nature, but please remember that the bad behaviour of others does not excuse us from acting in a civilized manner.

http://www.antionline.com/showthrea...ight=Antipoints

Hello again, sorry to drag thris thread on but I have one more question for Nihill:

You posted some valuable information with respect to reporting this individual for his behavior:

Quote:

---

http://www.usdoj.gov/criminal/cybercrime/reporting.htm

---

Quote:

---

think it is self explanatory.......remember to fill out the form 4017(US Secret Service) as well as the FBI one

---

But do you know if these are appropriate being as I am in Canada, and apparently, so is he?

I found out his ISP, but I am hesitant to push forward, for fear of retribution, as I know nothing of computer protection or security (I will after awhile longer on this site though) :)


Muerto0 - very helpful response, first time I assigned AP, thanks for the detail


Over and Out

[gloworange]Ummm i dont think theres anything you cant do... FBI and USSS are US only i believe im sure you can find something of that equivilant in Canada as your like our Step-brother/sister... so id say they prolly have it there... id check if i were you and report that guys bum arse[/gloworange]

Hey guys,

I too have the same issue as the poster above. Long story short, I got on yahoo messenger for the first time in a long while and got a message saying I violated the terms of service, something to that effect anyway. So like a fool, I clicked it, and now cannot sign on to my email with that account as it says the password has been changed. I went to the pest control site as suggested, but I must be honest...I'm a bit of a novice when it comes to computers. Can someone give me step by step instructions on how to get my yahoo password back? I'd be very grateful. Thanks for reading and for any assistance you can provide.

Hi,

I am not familiar with Yahoo as such, but most of these services have a "forgotten password" procedure. You generally have to answer some "secret" question that you set up when you created the account.

Go into that and it will tell you what your password is. Change it immediately ;)

taudette - In Canada, you complain to the 'ISP' with as much detail as possible. You can also complain to the messenger provider; again with as much detail as possible. Dates, Times are required. If it's a Telus account, they do take it seriously and will warn the client first, then disconnect them if it continues. To protect yourself from further harassment, you might consider changing you're messenger name.

Hmm i did a google search for this little program.
find it HERE
Anyhow sounds like a little skiddiot tool as the coding is very very messy. and AV picks it up as soon as you download the file.

here's a little right up about it and what they are claiming there fixed. i did try this program with a friend and we found that the program would get detected by the AV, and also you do not recieve the psswrd's etc but they get sent to the skiddy's that made the program.
As we followed the instructions on how to view these Stolen psswrd's, and it kept giving errors.

And the fact that it was easy to break the host and installer file should say alot for there programing skillz..

Quote:

---

MPS
Magic-PS series

MPS is a Powerfull Password Sender for
Yahoo! Messenger

MPS sends victim id & pass to your id

Work without any smtp and script

Tested on Win98-Me-2000-XP-NT


--------------
Magic-PS v1.43
--------------
1.Added change sender Icon from (jpg or software) to (None icon) after install.
2.Fixed for all languages of yahoo messenger (Chines - Arabic - italic and more....)
3.Fixed if Victim uses <Space> char in password , MPS can send it.
EX : user=john<Space>21 Pass=<Space><Space><Space>
4.Fixed If victim uses Html codes in password MPS can send it.
EX : if password is : 1234<br> then MPS send it to your id
with this method : PASS=1234[<]BR[>] ok?
MPS can filter < or > in the password... < change to [<] and > change to [>]
5.Fixed If victim uses Alt+code in password you can read it easy just copy and paste
password to Notepad or save message by yahoo messenger...... or Copy and Paste loged pass
to login page of yahoo messenger.....
if you want to see this password you must Copy and Paste this password to Notpad and save it
to text file and open this file in a MS-Dos Text viewer for viewing Actual password.
6.If Victim uses Smileys in password you can read it. just goto yahoo messenger
preferences/Messages/Misc and disable Emoticons.
7.You must Copy and Paste logs in to Notepad and save it or you must Save message
with logs by yahoo messenger and then change <Space> with Space char and change [<] with <and change [>] with > then use it.

Ex: Password is : 123 90<BR> with MPS filter change to : 123<Space><Space>90[<]BR[>]
Ex: Password is : <Space><Space> with MPS filter change to : [<]Space[>][<]Space[>]
Ex: Password is : [<]Space[>] with MPS filter change to : [[<]]Space[[>]]
Ex: Password is : [[[[[[<]</Html> with MPS filter change to : [[[[[[[<]][<]/Html[>]
Ex: Password is : 1234 Alt+255 a with MPS filter change to : 1234 a
you can not see this character--> ^
because victim uses Alt+Code in the password.
you must copy and paste this code to yahoo messenger login page.
if you want to see this password you must Copy and Paste this password
to Notpade and save it to text file and open this file in a MS-Dos
Text viewer for viewing Actual password.

-== very important : Copy and Paste loged user and pass then use it ==-

magic_h2001


Server:
dropped files:
c:\WINDOWS\spoolsvr.exe size: 12.012 bytes
c:\WINDOWS\SYSTEM\FlashPlayer32.exe size: 12.012 bytes

registry added:
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{143A6800-3I18-11C0-821H-4M4GICH20010S} "StubPath"
data: C:\WINDOWS\SYSTEM\FlashPlayer32.exe

---

Hey guys,

As an update, I called yahoo several times and got through to a couple of live people. I was given an email address for the password authentication issues which I sent to and pleaded my case. I was asked for my personal info and was asked the personal question that I provided for the account, which I KNOW the answer for, but for whatever reason, it came back as an invalid answer. This is so frustrating. I've lost a ton of sleep over this. I've searched the internet far and wide, and it seems like I'm just flat out screwed. It seems like whoever got my password also changed my personal information as well. Is there ANYTHING else I can do? I'm at my wits end here.

Quote:

---

This is so frustrating. I've lost a ton of sleep over this.

---

That's so funny as i couldn't see myself loosing any sleep over a simple yahoo issue.
Reality check try going outside into the real world and stop living in your cyber fantasy world.

Quote:

---

Is there ANYTHING else I can do?

---

Yes just register a new account. Get over it as it's only a yahoo user name not much to cry about really.. :eek:

I get outside a lot actually. I'm just sick and tired of these little teenage punks with nothing better to do than spread viruses around. If I never get the email account back, it's not the end of the world....it's simply the principle of the matter. I don't want some bot spamming the entire world and shilling some sexual enhancement products using MY email account in the process. If I have my way, I'll just get the account suspended when I contact yahoo tomorrow because apparently, there is nothing I can do. Oh well, what can you expect with a free service? Certainly not good customer service. Thanks for the replies anyways.

Once they get your password they can change the secret word or question in your account. In fact, they can change all of your personal info at that. Shouldn't yahoo have a past record of these things so they can tell from the day it's been changed? I think it would help greatly.

as somebody already said ITS """FREE SERVICE""" ....
what else can you expect from it.....
but it wud definitely help if there was some standard records which cannot be changed...