bombotmod = trojan

As everyone knows, a newly bombus version called "bombotmod" published (in [b freebuzz.ir [/b]by reza-dracula) few months ago (. It had these features: anti admin - s2a - avatar grabber - dc option ...

But some java clients may encounter to 2 connections during account binding to nimbuzz (the application requests 2 connections to access)

Have u ever seen this issue ;D?

ok after watching some topics about bombotmod which grabbed its users' symbolic ids, i attempted to investigate...

the result as follows:
1st check out this screen, i collected from running application via an java emulator on my pc

s2.picofile.com/file/7834533545/bombot.png



Look Carefully! During binding resource to id (Authentication), a socket opens to send anonymous data to "freebuzz.ir"  :D

I asked its programmer : "reza-dracula" the administrator of freebuzz.ir -he remarked that it's because of app updating status...

but i ask u this elusive question...why do these data transferring occur during authentication (the time that programmer is ensured of  id logging healthy )

the socket for updating the application must be far from jid logging to nimbuzz.

For approving my speech, i tested an id with wrong password. no socket opening was seen.

Good Luck

 good job