Trojan serves porn off home PCs,

net1

A new Trojan is turning Windows PCs into porn and spam relays, possibly as a means of harvesting credit card details, researcher Richard M. Smith has discovered.

At first it was suspected that the Trojan installs a Web server on the victim's machine from which the porn is served, but research by LURHQ indicates that it sets up a proxy which forwards the porn and x-rated spam and so keeps the originating server hidden.

Machines hosting the Trojan are not harmed in any way, but spam recipients who check out the porn on offer may become victims of fraud if they sign up for access using their credit cards.

The overall purpose appears to be establishing a semi-anonymous, distributed hosting scheme for malicious sites or for material that might invite retaliation from a Web host or the authorities, such as warez or kiddie porn.

Only about two thousand home machines have been infected, but among them is a high proportion of AOL subscribers, implying that it may be spread via instant messaging. According to LURHQ it is easy to detect and defeat.

First, remove this registry key:

Software\Microsoft\Windows\CurrentVersion\Run\Logi n Service = wingate.exe

Then reboot the computer and remove this file:

%windir%\system32\wingate.exe.

The spam ads direct users to Russian porn sites chiefly, sometimes using servers that were involved in a recent Paypal scam, Smith notes. ®

jimbo

Wingate is a legitimate software program for sharing a proxy server and setting up virtual private networks (VPN). So.....it's being 'dropped' into PCs where there are open ports. Important, then, to keep ports in stealth mode behind a firewall. Running 'Shields Up' will check the ports.

Jimbo