[Dshield] New paypal trojan

TRushing@hollandco.com TRushing at hollandco.com
Fri Apr 30 18:06:38 GMT 2004


I'm sure that viruses/trojans have been doing things like this for a 
while, but this was the first time I had seen anything like this.

http://www.sophos.com/virusinfo/analyses/trojwebdlna.html

It edits the hosts file to add an entry for www.paypal.com and then adds a 
new trusted root certificate for the fake paypal.com site.

         ---Tim Rushing



More information about the list mailing list