Re: QNPC.Thief.Trojan

Ciao,
in questa collezione
http://studenti.scuole.bo.it/~bel19095/HACK/hackmain.htm
lo definiscono "Password Thief - Forse il miglior Keylogger."

e in quest'altra
http://mx.geocities.com/goodhackermx/programashacker.htm
e' sempre nella sezione dei keylogger.

Viene riconosciuto come QNPC.Thief anche da McAfee.

Di seguito includo alcuni stralci dei file readme.txt e guide.wri della
distribuzione scaricata da uno dei link precedenti
(http://mx.geocities.com/goodhackermx/thief100.zip).


---> begin readme.txt
.....
Program Description
-------------------

Esm Software's Password Thief is part of the Mr. Burns
Productivity monitoring package.  A small application
that runs quietly hidden in the background taking note
of all passwords that have been entered.  This includes
user login passwords, screen saver passwords, internet
access passwords, Microsoft Word  password, or any password
entered by any program.  Use the Password Thief's
administration program to then review summaries.
A great way of consolidating your (or other users) passwords.
Perfect for those we keep forgetting!  With the Password
Thief you will never have the problem of people keeping
information from you by encrypting the files using various
techniques. Can be configured to startup quietly every time
the computer is run.
.....
---> end readme.txt

---> begin guide.wri
.....
The Password Thief consists of three program files:
Thief.exe
pwthook.dll
PWTManger.exe
Only two of these files (Thief.exe and pwthook.dll) must be present
for the program to run. The third is only necessary for configuring the
program and viewing the password logs.
To install The Password Thief onto a system copy the files Thief.exe
and pwthook.dll into the windows system directory (usually called
c:\windows\system or c:\win95\system).
.....
---> end guide.txt

Buona giornata
Dario Guffanti

--------------------------------
Dario Guffanti 'edg' <edg@planet.it>
ICT Consultant
--------------------------------



----- Original Message -----
From: "Luca Cravero" <cravero@softhome.net>
To: <ml@sikurezza.org>
Sent: Thursday, 11 October, 2001 18:33
Subject: QNPC.Thief.Trojan


> Ciao, tramite Norton ho appena scoperto su di una macchina NT server
questo
> simpatico e poco documentato trojan. Qualcuno ha qualche informazione a
> riguardo?
>
> Scan type:  Manual Scan
> Event:  Virus Found!
> Virus name: QNPC.Thief.Trojan
> File:  C:\WINNT40\Profiles\Administrator\Local Settings\Temporary Internet
> Files\Content.IE5\89ABCDEF\thief100[1].zip>>Thief.exe
> Location:  Quarantine
> Computer:  xxx
> User:  Administrator
> Action taken:  Clean failed : Quarantine succeeded :
>
> --
> Luca Cravero
> Linux Registered User #223881
>
>
>
>
> ________________________________________________________
> http://www.sikurezza.org - Italian Security Mailing List
>


________________________________________________________
http://www.sikurezza.org - Italian Security Mailing List