[ISN] Fake Lycos screensaver harbours Trojan

[InfoSec News]

http://www.theregister.co.uk/2004/12/07/fake_lycos_screensaver_trojan/

By John Leyden
7th December 2004

Virus writers have begun distributing their wares in emails that pose
as Lycos's abandoned "Make love not spam" screensaver.

The fake screensaver emails contain an attachment with a RAR SFX
archive that has embedded key logger Trojan inside, antivirus firm
Sophos warns. Infected emails come in emails with subject lines such
as "Be the first to fight spam with Lycos screen" and an attachment
called "Lycos screensaver to fight spam.zip".

Upon successful installation, the key logging Trojan (Mdropper-IT)  
sends a message to an Indonesian email address confirming its status.  
The screensaver file, rather than displaying the Lycos screensaver,
displays a blank screen.

"Make Love Not Spam" was designed to bombard spam websites with
requests, so increasing their bandwidth charges without - in theory -
shutting them down. Security firms criticised Lycos's use of
"vigilante tactics" especially when two of the targeted websites
became unavailable. Several major internet backbone providers and ISP
blocked access to Lycos' www.makelovenotspam.com website over concerns
over its questionable legality.

Lycos denied it was doing anything wrong, much less creating a DDoS
attack platform, but it suspended screensaver downloads after spammers
began redirected traffic back to makelovenotspam.com.

This won't necessarily stop people falling for the VX ruse,
unfortunately; fake Lycos screensavers will likely become a staple of
social engineering tricks for weeks to come.