ProAgent 1.2
(Trojan-Spy.Win32.ProAgent.12)

by ATmaCA

Written in C++

Released in July 2003

Made in Turkey

more versions


What's new
-----------------------------------
 '+' = New feature
 '-' = Bug fixed or Removed
 '*' = Improved or Changed
-----------------------------------
===================================
Version 1.2   
16/7/03
===================================

+ Added support for MS Outlook passwords. (POP3 accounts only) 
+ Added support for Eudora passwords.
+ Added support for IncrediMail passwords.
+ Added support for Group Mail Free  passwords.
+ Added support for MSN Explorer passwords. 
+ Added support for AutoComplete passwords in Internet Explorer
+ Added support for Password-protected sites in Internet Explorer
+ Added property "screenshoot quality" manual
+ Added property "Melt server on install" manual
+ Added property "Upx unpack" manual
+ Added property "Fake error message" manual
+ Added property "Interval(delay) in seconds between data sending retries" manual

- Fix the bug "When server startup,automaticly run outlook express to recovery passwords"
- Fix the bug "Driver_32 error on win9x"

ATmaCA


Server:
dropped files:
c:\WINDOWS\SYSTEM\dtxservice.exe 
c:\WINDOWS\CRSS.EXE 
c:\WINDOWS\fps.atm 
c:\WINDOWS\fps.exe 
c:\WINDOWS\icq.dll 
c:\WINDOWS\iss32.exe 
c:\WINDOWS\kdd32.atm 
c:\WINDOWS\kt.atm 
c:\WINDOWS\ktd32.atm 
c:\WINDOWS\mps.atm 
c:\WINDOWS\mps.exe 
c:\WINDOWS\SYSTEM\dtxservice.exe 
c:\WINDOWS\SYSTEM\ekran_g.jpg 

added to registry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run "DirectX For Microsoft� Windows" 
HKEY_LOCAL_MACHINE\Software\Microsoft\Protected Storage System Provider\*Default*\Data 2\Windows "Value" 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run "DirectX For Microsoft� Windows" 

MegaSecurity