Fake XBox Emulator Gets A Stinging UpdateBrian McWilliams
A re-tooled version of a Trojan horse program that claims to run Microsoft XBox video games on personal computers has hit the Web, marking the latest effort by Internet scam artists to prey on gullible game aficionados.
Like an earlier version of the hoax, the program, uploaded to three Angelfire.com Web sites on May 12, does not deliver on its promise to give users the ability to turn their PCs into XBox consoles. Instead, the Trojan, a file called EMU_xbox.exe, installs a small "dialer" program named StealthXP.exe, according to an analysis by Newsbytes.
In an apparent effort to rack up money for its author at pay-for-click and other sites, StealthXP.exe contacts several Web sites, including Scorpionsearch.com.
According to Kurt Stiener, the operator of Scorpionsearch.com, he is not directly responsible for creating StealthXP.exe, although the program's file properties list him as the author.
Stiener said the software appears to be an unauthorized version of a program by the same name that he licenses to Webmasters of pornography sites. According to Stiener, such "affiliates" earn commissions from him for distributing the program to their visitors. Once installed on a user's PC, Stiener's StealthXP program is designed to generate pop-up ads and click-throughs to adult sites, he said.
According to Stiener, a configuration program bundled with StealthXP is supposed to prompt users for input. But he said the program, Dconfig.exe, has been tampered with in the version contained in the latest copy of EMU_xbox.exe and does not ask for user input before installing StealthXP.
Stiener declined to identify the individual responsible for distributing the Trojan, but he said he has eliminated the affiliate from his network.
"It is against the terms of service to distribute StealthXP in any non-adult setup," said Stiener.
On May 9, after being contacted by Newsbytes, officials at Terra-Lycos disabled an Angelfire site that offered the original "XBox emulator" in a set-up file named EMU_xbox.exe. When executed, that installer launched a program called NetBUIE.exe that contacted several remote sites, including Scorpionsearch.com.
Terra-Lycos representatives were not immediately available for comment on the new sites.
According to Stiener, he was not the author of an e-mail message reportedly received by the VNUnet news service this week from an individual calling himself "Scorpion." The news service reported May 14 that the NetBUIE.exe program was not malicious, and that Scorpion claimed it would do no harm to user's computers.
Anti-virus software vendors, including Symantec, Kaspersky, and Sophos, have recently added detection for the NetBUIE.exe Trojan to their products.
Reported by Newsbytes, http://www.newsbytes.com .
(20020515 /WIRES PC, LEGAL, ONLINE, BUSINESS/XBOXLOGO/PHOTO)
COPYRIGHT 2002 Washingtonpost Newsweek Interactive
COPYRIGHT 2002 Gale Group