INFECTIONS AGAIN

Article View: alt.hacker

Article #205

#205

From: joandarc.or.joan930
Date: Thu, 12 Jun 2008 10:43

23 lines
2357 bytes

Ups again!

In the last day or so, there has been some discussion, particularly in
EDU circles, about some sort of bot programs infecting computers and
displaying "Yay2". (The Attentive Reader will be amused that malcode
would actually announce its presence, but that's beside the point).
It's not yet clear where they're getting the second Yay-bot from, but
part of the mystery is now solved. The purpose of the Yay-bot is to
install a piece of adware/spyware called WinBudget. This is a Browser
Helper Object that appears to monitor all the major search engines,
and hijack the search results, displaying its own popups as well.A win-
win siuation.

I guess we can speculate that the dork^h^h^h^h programmer who wrote
the installer must have been a bit of a newbie, and was thrilled to
find his code actually worked... thus the "Yay2". The BHO, however,
works quite well and is a real nuisance, and i`ve taken the precaution
of blocking the BHO install site.

--


Jane Barrymore

Technical Details

Message-ID: <668e8923-a498-4b36-9ea8-f21113fc5b40@25g2000hsx.googlegroups.com>

Path: arc1-ca.pugleaf.net!g2news1.google.com!postnews.google.com!25g2000hsx.googlegroups.com!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Thread: 102c45,31f1965443914dee,start
X-Google-Thread: 10a617,31f1965443914dee,start
X-Google-Thread: 10bb54,31f1965443914dee,start
X-Google-Thread: 1156f6,31f1965443914dee,start
X-Google-Attributes: gid102c45,gid10a617,gid10bb54,gid1156f6,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!postnews.google.com!25g2000hsx.googlegroups.com!not-for-mail
From: joandarc.or.joan930@gmail.com
Newsgroups: alt.hacker,alt.hackers.malicious,alt.2600,demon.local
Subject: INFECTIONS AGAIN
Date: Thu, 12 Jun 2008 03:43:35 -0700 (PDT)
Organization: http://groups.google.com
Lines: 23
Message-ID: <668e8923-a498-4b36-9ea8-f21113fc5b40@25g2000hsx.googlegroups.com>
NNTP-Posting-Host: 84.212.228.230
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Trace: posting.google.com 1213267415 15778 127.0.0.1 (12 Jun 2008 10:43:35 GMT)
X-Complaints-To: groups-abuse@google.com
NNTP-Posting-Date: Thu, 12 Jun 2008 10:43:35 +0000 (UTC)
Complaints-To: groups-abuse@google.com
Injection-Info: 25g2000hsx.googlegroups.com; posting-host=84.212.228.230; 
 posting-account=Nsy9EQkAAAAdwOjjgYEwvN1dEbpY8kL0
User-Agent: G2/1.0
X-HTTP-UserAgent: Mozilla/5.0 (Windows; U; Windows NT 6.0; nb-NO; rv:1.8.1.14) 
 Gecko/20080404 Firefox/2.0.0.14,gzip(gfe),gzip(gfe)