(Trojan-Spy.Win32.ProAgent.21)
by ATmaCA
Written in C++
Released in October 2005
Made in Turkey
Download
============================[ ProAgent v2.1 (11.08.2005) ]============================
How To Use Pro Agent (in urdu).
SaB say Pehle apna antivirus uninstall ya disable kareen.
kyon kay yeh program torjan hota hai.Aur torjan computer
Kuch nahi hota.Yeh sirf victam ki information send karta hai.
ab aap e-mail main apna email adress dain. Jis par information aaye.
aur create server kar dain.app is ko kisi pic ka sath bhi attach kar
kay server bana saktay hain is say victiom ko maloom nahin ho ga kay aap
ussay hack kar rahay hain phir create server par click kar dain us folder
main server ban jaye ga ab aap yeh file jis ko bhi send kareen gaye woh
hackho jaye ga us ki information aap kay pass aa jaye gi.
======================================================================================MegaSecurity
[+] All the files made undetected against antiviruses.
[+] Virtual Keyboard Logging support added to Special Editions.
[+] MultiLanguage support added.
[+] Server extensions menu added.
[+] Advanved settings menu added.
[+] Shell icons support added into icons menu.
[+] Three characters limit for the extension of binded file improved. Any extensions
with the any length will be accepted.
[+] 10 MB limit for the binded file improved. Any file with any size will be accepted.
[+] Grabbing more game-program serials support added.
[+] Anti-rootkit bypass methods improved.
[+] Grabbing FtpNow Passwords support added.
[+] Grabbing DeluxeFtp Passwords support added.
[+] Grabbing DeluxeFtp Pro Passwords support added.
[+] Grabbing Morpheus Passwords support added.
[+] Grabbing BitComet Passwords support added.
[+] Grabbing FireFly Passwords support added.
[+] Injection to Default browser method improved.
[+] Injection to Default E-Mail Client feature added.
[+] No-Injection feature added.
[+] Automatic Server Uninstall on specified date feature added.
[+] Delay Execution feature added in two options (after first restart or after a
specified date).
[+] Server for once time only support added (If you select this option, server will
send you reports only once than it will remove itself).
[+] Regularity of server logs improved.
[+] E-Mail report sending module made more stable.
[+] Added bypassing features for McAfee and Norton antivirus mail scan modules.
[+] And lots of improvements...
ATmaCA
Server:
dropped files:
c:\WINDOWS\system32\drivers\KeenSense.sys Size: 16 bytes
c:\WINDOWS\system32\drivers\ksdevice.sys Size: 16 bytes
added to registry:
HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
HKEY_CURRENT_USER\Software\Ghisler
HKEY_CURRENT_USER\Software\mirabilis
HKEY_CURRENT_USER\Software\NirSoft
HKEY_CURRENT_USER\Software\RIT
HKEY_LOCAL_MACHINE\SOFTWARE\Ghisler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\&RQ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian
HKEY_LOCAL_MACHINE\SOFTWARE\mirabilis
HKEY_LOCAL_MACHINE\SOFTWARE\Miranda
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "qservices"
data: C:\WINDOWS\qservice.exe
tested on Windows XP
August 26, 2005