🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: aol.techchat
Article #38

Another Trojan Horse?

#38
From: Frank Sconzo
Date: Wed, 15 Apr 1998 00:00
53 lines
2942 bytes
Greetings!

I visited my cousin's house yesterday after he pleaded with me to help
him restore his AOL 3.0 software to working order.

He downloaded (>>eek<<) something from someone he didn't know... 
(>>>>super-eek!!!<<<<) and ended up screwing up his account.

He said that after an execution of a download, (not sure what the
executable's name was) he could no longer type in his password at the
sign-on screen.

He has since erased all his downloaded files and run a newly purchased
copy of McAfee to NO AVAIL.   Well, this is not surprising since he was
probably infected by a trojan horse.

What I am interested in finding out... has anyone heard of this
particular trojan horse? When he executes AOL 3.0, the sign-on screen
appears, then he chooses his account name, or any account name for that
matter (including the master account name), but cannot type in his
password. Hitting tab or selecting the password box yields no results.
The cursor does not appear in the text box... He MUST sign on as guest
or enter his password under Members:Preferences:Passwords in order to
get online.

He is sure that someone has already used his account because his Profile
has been changed once. 

So..... I wiped out his AOL directories (2.5 and 3.0), emptied his
recycle bin, and reinstalled AOL 3.0 with a fresh disk.
And.... walla.. NOT.    As soon as we configured the new installation of
AOL, he STILL couldn't type in his password.

Perhaps AOL utilizes DLLs in a system directory which I didn't wipe
out... and the trojan horse replaced those DLLs with custom-hacker
programmed DLLs? But, a new Installation of AOL should have written over
any DLLs in any system directories.  ...Or... Has his account somehow
been tampered with on AOL's server? (I doubt the latter could happen...
lol)

Anyway, this is getting long winded. Sorry.

Has anyone heard of this circumstance happening to someone?

The next step would be for me to do a fresh install of AOL on a
different computer with his account and see if it happens again. If so,
then he should cancel his account. If not, then indeed, there is still
some corrupted program on his computer... and if I don't find out what
it is, we'll have to slick the disk and start all over with a fresh disk
and a fresh operating system, etc....

See ya!   Thanks!
Technical Details
Message-ID: <35358183.676F@erols.com>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 111e61,99421274c97c7136,start
X-Google-Attributes: gid111e61,public
From: Frank Sconzo <fsconzo@erols.com>
Subject: Another Trojan Horse?
Date: 1998/04/15
Message-ID: <35358183.676F@erols.com>
X-Deja-AN: 344546804
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0
Reply-To: fsconzo@erols.com
Content-Type: text/plain; charset=us-ascii
X-Complaints-To: abuse@erols.com
X-Trace: winter.news.erols.com 892698921 3212 207.172.166.117 (16 Apr 1998 03:55:21 GMT)
Organization: Home Account
Newsgroups: aol.techchat