Trojan Horse Infests 15,000 Internet Chat Users Back Orifice, the controversial hacker tool released in August that exposes Windows 98 machines to remote manipulation over a network, may have found its way onto 15,000 or more computers, thanks to a Trojan horse that was released on the Internet chat network. GeoCities has been receiving requests for the file since Aug. 18, and the number grew to more than 15,000 until the high traffic caught the company's attention. Neither GeoCities members or systems were ever endangered, according to a company spokesman. Calif. GeoCities would not say if the company knows who or where the file came from, or what steps it is taking to track down the perpetrator. Although IRC has many channels dedicated to everything from computer games to TV shows, there are also channels with nothing but files to transfer, including pornographic pictures and videos, MP3 music, software, and even movies.
Bots can serve up hundreds or thousands of files in the course of a day.
When an IRC user requested a file, a bot then sent the Trojan horse along with the requested file. Once the Trojan horse got onto the user's computer, it fetched the nfo.zip file from the GeoCities server. Also, like Back Orifice, once the computer is infected, a remote user can access and control the computer. The Internet is a risky place, and taking files from unknown sources is really exposing oneself to risk, said one analyst. Balderston isn't surprised an enterprising hacker has found a newer, more effective way to get Back Orifice onto people's computers.