Y2KCount: a Trojan that Searches for Passwords in E-mail Messages.

SAN FRANCISCO--(BUSINESS WIRE)--September 17, 1999--

Y2KCount (aka "Polyglot") uses electronic mail to reach its victims, guised as a message with the "Microsoft Announcement" subject and "[e-mail]" as the sender. The e-mail contains an attachment called Y2KCount.exe that, when executed, installs the Trojan on the system.

This Trojan has been found circulating around the Internet, as the UK has informed us:

"Since last night, we have seen 3 copies of this Trojan. Our analysis lead us to suspect that this was a virus, and we therefore put protection in place immediately, using our own emergency scanner," says Alex Shipp, virus technologist at Star Internet. Star is unique in that it is the only ISP worldwide who protect their customers by scanning all e-mails for viruses. "Initial analysis showed many similarities to ExploreZip; the method of propagation via email is similar," says Shipp.

As well as other Trojans and worms, Y2KCount uses social engineering to dupe users. The following text is found in the message body:

"To All Microsoft Users,

We are excited to announce Microsoft Year 2000 Counter.
Start the countdown NOW. Let us all get in the 21 Century.
Let us lead the way to the future and we will get YOU there FASTER and
SAFER.

Thank you,

Microsoft Corporation"

When the attachment is executed, Y2KCount starts infecting the computer and displays a message that is similar to WinZIP error warnings:

"Error!..Password protection error or invalid CRC32"

After this message has been displayed, the Trojan drops the PROCLIB.DLL, PROCLIB.EXE, PROCLIB16.DLL and NTSVSRV.DLL files into the Windows System directory and modifies the SYSTEM.INI file. It then overwrites WSOCK32.DLL with PROCLIB16.DLL, and saves a copy of WSOCK32.DLL as a file called NLHVLD.DLL.

The destructive effects of Y2KCount are triggered off when the infected PC receives a "signal" from port 5888, supposedly sent by the Trojan's author. From this point onwards, Y2KCount monitors up to 10 transmissions simultaneously. Its objective is to steal the victim's password or user name in order to subsequently send it to the author.

Panda has added this latest threat to its virus signature file in order to effectively protect Panda Antivirus users.

About Europe's Leading Independent AV Developer

Panda Software offers a great variety of solutions aimed at satisfying the specific needs of all kinds of users, from large companies with complex networks to home users. Among a wide range of products, the leading two are Global Virus Insurance 24h-365d and Panda Antivirus 6.0 Platinum.

Panda has been awarded antivirus quality certifications by the International Computer Security Association (ICSA) and West Coast Lab's Checkmark, making it the only developer with solutions certified by both institutions for Windows 98, Windows 95, Windows 3.x, Windows NT Workstation, OS/2, DOS, Windows NT Server and Novell NetWare. Panda has also recently obtained the highest qualification in virus detection and disinfection (Checkmark Level Two and ICSA.net Cleaning) and anti-Trojan tests (Trojan Checkmark).

For further info and evaluation copies, please visit http://www.pandasoftware.com/corporate.