Drudgereport Putting Trojans out???

Gertting nothing in IE. May want to dump the AOL browser sparky

nothing here either on both comps
norton on 1 and mcafee on the other

Ironic photo caption and headline.

Prolly spyware. ;)

Hahahah! I didn't notice that! Classic...

Yep it's AOL but what gets me is AOL has all this spyware, anti-virus bs they tout. They caught it though.

Don't know if it gets through the standard IE browser. If AOL caught it, I'll stick with AOL.

Drudge has too many pop ups. He doesn't need them. His site is so damned popular he can charge through the roof.

Upon execution, this Trojan checks for the system?s Internet connection. It then creates new registry entries in order to lower the Internet security settings of the user?s default browser.

This Trojan downloads files from the following URLs:


http://static.topconverting.com/acti...nningsgame.exe
http://static.topconverting.com/activex/tcupdater.exe
http://static.topconverting.com/activex/180ax.exe
http://static.topconverting.com/activex/optimize.exe
http://static.topconverting.com/activex/games.exe
It adds the following registry keys and entries:

HKEY_CLASSES_ROOT\LOADER2.Loader2Ctrl.1


HKEY_CLASSES_ROOT\LOADER2.Loader2Ctrl.1
@ = "Loader2 Control"

HKEY_CLASSES_ROOT\LOADER2.Loader2PropPage.1

HKEY_CLASSES_ROOT\LOADER2.Loader2PropPage.1
@ = "Loader2 Control"

HKEY_CLASSES_ROOT\LOADER2.Loader2Ctrl.1\CLSID

HKEY_CLASSES_ROOT\LOADER2.Loader2Ctrl.1\CLSID
@ = "{79849612-A98F-45B8-95E9-4D13C7B6B35C}"

HKEY_CLASSES_ROOT\CLSID\{38601801-2FF5-4A62-95DA-D2007161C1B4}

HKEY_CLASSES_ROOT\CLSID\{38601801-2FF5-4A62-95DA-D2007161C1B4}
@ = "Loader2 Property Page"

HKEY_LOCAL_MACHINE\Software\Classes\LOADER2.Loader 2Ctrl.1
@ = "Loader2 Control"

HKEY_LOCAL_MACHINE\Software\Classes\LOADER2.Loader 2Ctrl.1\CLSID


HKEY_LOCAL_MACHINE\Software\Classes\LOADER2.Loader 2Ctrl.1\CLSID
@ = "{79849612-A98F-45B8-95E9-4D13C7B6B35C}"

HKEY_LOCAL_MACHINE\Software\Classes\CLSID\
{38601801-2FF5-4A62-95DA-D2007161C1B4}

HKEY_LOCAL_MACHINE\Software\Classes\CLSID\
{38601801-2FF5-4A62-95DA-D2007161C1B4}
@ = "Loader2 Property Page"





Analysis By: Carlo Panganiban

Revision History:
First pattern file version: 2.364.06
First pattern file release date: Jan 21, 2005

Smokey, one of my guys said the same thing.

It don't happen on IE only AOL browser which says to me that either AOL's security is better and catching it or that something else is going on. Why it would pop up during a Drudge load is unknown.

People have called into his show bitching about his popups and trojans or something but I thought they were joking.