ICQ Trogen 1.0

· Overview ·
· Origins ·
· Operation ·
· Detection and Removal ·
· Research ·

Overview

Summary:

 DOS-based trojan written for ICQ.

Vendor Notes:

 from the doc: 'Icqtrogen.exe is made to be placed in your icq folder and move the real icq to icq2.exe. netdetect calls our icq and ours calls icq2 so the user can't see it. Also, my icq Trojan has NO user interface, the only way to see it is to ctrl-alt-del and see if it around. This program opens a port and sits there lissing for a connection. The idea is simmalar to TFTP.'

Alias:

 Backdoor Program [Panda], Backdoor.SPing.a [Kaspersky], Backdoor.SPing.a2 [Kaspersky], Backdoor/ICQ_206.129 [Computer Associates], Backdoor/SPing.A [Computer Associates], Backdoor/SPing.A2 [Computer Associates], Backdoor/Sping.A2.b [Computer Associates], Bck/Sping.A2 [Panda], destructive program [F-Prot], security risk or a "backdoor" program [F-Prot], SPing [McAfee], Trj/ICQ [Panda], Trj/ICQ.Clt [Panda], Vortex Trojan, Win32.SPing [Computer Associates], Win32.SPing.a2 [Computer Associates]

See Also:

 ICQ Trojan

Category:

AOL Pest: Any password stealer, exploit, DoS attack, or ICQ hack aimed at users of AOL. ICQ is an instant messenger service from mirabilis.com, now AOL. ICQ is a favorite service among hackers, and ICQ features are built into many trojans (such as stealing user's passwords, UINs, or notifying the hacker). Users of ICQ are warned ""By using the ICQ service and software... you may be subject to various risks, including... Spoofing, eavesdropping, sniffing, spamming, breaking passwords, harassment, fraud, forgery, 'imposturing', electronic trespassing, tampering, hacking, nuking, system contamination including without limitation use of viruses, worms and Trojan horses causing unauthorized, damaging or harmful access and/or retrieval of information and data on your computer and other forms of activity that may even be considered unlawful.""

Backdoor: A secret or undocumented means of getting into a computer system, or software that uses such a means to penetrate a system. Some software has a backdoor placed by the programmer to allow them to gain access to troubleshoot or change the program. Software that is classified as a "backdoor" is designed to exploit a vulnerability in a system, and open it to future access by an attacker.

Trojan: Any program with a hidden intent. Trojans are one of the leading causes of breaking into machines. If you pull down a program from a chat room, new group, or even from unsolicited e-mail, then the program is likely trojaned with some subversive purpose. The word Trojan can be used as a verb: To trojan a program is to add subversive functionality to an existing program. For example, a trojaned login program might be programmed to accept a certain password for any user's account that the hacker can use to log back into the system at any time. Rootkits often contain a suite of such trojaned programs.

Similar Pests:

 AOL Pest · Backdoor · Trojan

Origins

Author:

 Steam

Group:

 Doxoon

Date of Origin:

 August, 1998

Operation

Storage Required:
  • ICQ Trogen 1.0: at least 233 KB
    		•

    Detection and Removal

    Automatic Removal:

    PestPatrol detects this.

    PestPatrol removes this.

    Manual Removal:

    		 Follow these steps to remove ICQ Trogen 1.0 from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.
    Stop Running Processes:

    Kill these running processes with Task Manager:

    Remove Files:

    Remove these files (if present) with Windows Explorer:

    Research

    File Analyses:

    More Info:
  • AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
    		•

    Research By:
  • PestPatrol's Pest Research Center
    		•

    Last Revised:

    		 April 03, 2005