WPS 1.4
(Trojan-PSW.Win32.YahooPass.fb)
(Trojan-PSW.Win32.YahooPass.fw)

by W32_Cr4Ck3r

Written in Visual Basic

Released in January 2008

Made in Iran

more versions


Send Yahoo Passwords (6,7,8,9)
Send Dial-Up Passwords
Send IE User& Password
SEnd Hardware Info
Send IP
Send Computer Name
Send Win User Name
Send OS Name
Disable Y!Save Password
Disable Regedit
Disable Ms Config
Disable Task Manager
Disable Win FIREWALL
Disable AntiVirus Programs
Delete Message Archice
Hide Start Button
Hide Clock
Crazy Mouse
Destroy TaskBar
Disable Group Policy
Auto Startup
Melt After install
Fake error Message
On first run


Server
Dropped File:
c:\WINDOWS\system32\Explorer.exe    Size: 53,237 bytes 
c:\WINDOWS\system32\yupdater.exe    Size: 53,237 bytes 

Added to Registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Yahoo Auto Updater"
Data: C:\WINDOWS\system32\yupdater.exe 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices "Shell"
Data: C:\WINDOWS\system32\Explorer.exe 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices "Yahoo Auto Updater"
Data: C:\WINDOWS\system32\yupdater.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Yahoo Auto Updater"
Data: C:\WINDOWS\system32\yupdater.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce "Yahoo Auto Updater"
Data: C:\WINDOWS\system32\yupdater.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce "Yahoo Auto Updater"
Data: C:\WINDOWS\system32\yupdater.exe 



Tested on Windows XP
November 23, 2008

MegaSecurity