Magic PS 1.43

Released 20 years, 8 months ago. January 2004

By magic_h2001

Informations

From	Iran
Author	magic_h2001
Family	Magic PS
Category	Information Stealer
Version	Magic PS 1.43
Released Date	Jan 2004, 20 years, 8 months ago.
Language	Delphi

Additional Information

Server:
dropped files:
c:\WINDOWS\spoolsvr.exe               size: 12.012 bytes 
c:\WINDOWS\SYSTEM\FlashPlayer32.exe   size: 12.012 bytes

registry added:
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{143A6800-3I18-11C0-821H-4M4GICH20010S} "StubPath" 
data: C:\WINDOWS\SYSTEM\FlashPlayer32.exe

Author Information / Description

=============================================
                .:: MPS ::.
              Magic-PS series

   MPS is a Powerfull Password Sender for
            Yahoo! Messenger

   MPS sends victim id & pass to your id

    Work without any smtp and script ;)

       Tested on Win98-Me-2000-XP-NT
=============================================
	   
--------------
Magic-PS v1.43
--------------
1.Added change sender Icon from (jpg or software) to (None icon) after install.
2.Fixed for all languages of yahoo messenger (Chines - Arabic - italic and more....)
3.Fixed if Victim uses <Space> char in password , MPS can send it. 
  EX : user=john<Space>21 Pass=:)<Space><Space>;D<Space>
4.Fixed If victim uses Html codes in password MPS can send it. 
  EX : if password is : 1234<br> then MPS send it to your id
  with this method : PASS=1234[<]BR[>] ok? 
  MPS can filter < or > in the password... < change to [<] and > change to [>]
5.Fixed If victim uses Alt+code in password you can read it easy just copy and paste 
  password to Notepad or save message by yahoo messenger...... or Copy and Paste loged pass
  to login page of yahoo messenger.....
  if you want to see this password you must Copy and Paste this password to Notpad and save it 
  to text file and open this file in a MS-Dos Text viewer for viewing Actual password.
6.If Victim uses Smileys in password you can read it. just goto yahoo messenger 
  preferences/Messages/Misc and disable Emoticons.
7.You must Copy and Paste logs in to Notepad and save it or you must Save message 
  with logs by yahoo messenger and then change <Space> with Space char and change [<] with <
  and change [>] with > then use it.    

Ex: Password is : 123  90<BR>;):D    with MPS filter change to : 123<Space><Space>90[<]BR[>];):D
Ex: Password is : <Space><Space>     with MPS filter change to : [<]Space[>][<]Space[>]  
Ex: Password is : [<]Space[>]        with MPS filter change to : [[<]]Space[[>]]
Ex: Password is : [[[[[[<]</Html>    with MPS filter change to : [[[[[[[<]][<]/Html[>]
Ex: Password is : 1234 Alt+255 a     with MPS filter change to : 1234  a
                         you can not see this character-->            ^
                         because victim uses Alt+Code in the password. 
                         you must copy and paste this code to yahoo messenger login page.
                         if you want to see this password you must Copy and Paste this password 
                         to Notpade and save it to text file and open this file in a MS-Dos
                         Text viewer for viewing Actual password.

  -== very important : Copy and Paste loged user and pass then use it ==-
	   
magic_h2001