Trojan:W32/Promail
Summary
An application called Promail 1.21 is a trojan. This version was distributed on several shareware sites in March 1999.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
-
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
-
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
-
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
When Promail 1.21 is run, it tries to steal the current user's passwords and other information.
Promail is supposed to be a free program to maintain several email accounts belonging to a single user. Promail is written in Delphi and packed with Petite executable file compressor.
The copyright belongs to SmartWare Inc. (most likely fake), and the About box states that the program is based on an open source code by Michael Haller. Mr. Haller has nothing to do with the trojan. He has developed a free program Phoenix Mail program earlier and has made the full source code of it available. Now some malicious person has taken the source code, modified it to include the password stealing routine and is distributing it as Promail. Promail creates its own accounts (entries) for each email account a user maintains. When a user creates new accounts in Promail he is instructed to enter the following information:
- Real name
- Organization
- Reply-to email adderss
- Reply-ty real name
Then the user is supposed to enter information about his POP3 and SMTP accounts:
- POP3 user name
- POP3 password
- POP3 server name
- POP3 port (default: 110).
- SMTP server name
- SMTP port (default: 25).
Account information is written to ACCOUNT.INI file that is located in a folder that Promail creates for each email account a user maintains. The POP3 password is stored in an encrypted form (with weak crypto).
When a user tries to get email from any of maintained accounts the Promail first emails the contents of ACCOUNT.INI files to a free web-based email service provider NetAddress (account: naggamanteh@usa.net). So the person who owns this account (and is supposed to be the author of Promail password stealing trojan), gets all information about users' email accounts on different mail servers.
The Promail also creates an empty file PROMAIL.PML which servers as a flag for the trojan that not all ACCOUNT.INI files have been sent to the author of the trojan.
If you are using or were using Promail, it is HIGHLY recommended that you changed all your passwords because your accounts could be used by trojan author or other hackers for illegal purposes or for spying after you.