[Dshield] New paypal trojan

TRushing@hollandco.com TRushing at hollandco.com
Fri Apr 30 18:06:38 GMT 2004

I'm sure that viruses/trojans have been doing things like this for a 
while, but this was the first time I had seen anything like this.


It edits the hosts file to add an entry for www.paypal.com and then adds a 
new trusted root certificate for the fake paypal.com site.

         ---Tim Rushing

More information about the list mailing list