Is this program (WordzWizard) a trojan?

Factual Questions
1

I downloaded this program WordzWizard from http://wordzw.cncoffice.com/ww/ It’s a program that generates a list of all words from a provided 6-letter word.

When I run it, it creates a file called passwo.rds that contains this text repeated over and over again: “123456”

I emailed the maker and he says that:

  1. The repeating numbers are actually the encrypted version of their dictionary.
  2. He says its called passwo.rds to throw off would be hackers.

I’m not sure how much I believe him… Does anyone have any experience with this program? Can anyone disassemble it to see if it actually does more that what its supposed to? How can I check to see if its sending out any information?

I am running Norton Antivirus, and just scanned my entire system with Ad Aware, it didn’t turn up anything.

Any ideas?

Thanks!

2

The ‘passwo.rds’ thing sounds like a bad joke, actually. It cannot encode anything worthwhile (it’s just four numbers repeating) and it has a name reminiscent of a bad movie. Like saying ‘Secret Access Hatch’ or ‘Top Secret Bomb Plans’.

Here’s a plan: See if you can get the person to reveal his encryption algorithm. The file sounds like no encrpyted file I’ve ever seen or heard mention. 123456 repeating, indeed.

There are plenty of anagram generators, which is what WordzWizard is, online. I like the Anagram Genius Server. Use google to find more, both online and downloadable.

3

The only “algoritm” that I can think of is this:

The set of numbers 123456 repeats a certain number of times in the file, say 27. So 27 is the “encrypted” key to their software.

May or may not be so.

However, I did run windump while I used the program, and didn’t see any related network traffic moving, so I figure that I’m safe and they didn’t steal my information. :slight_smile:

4

The only “algoritm” that I can think of is this:

The set of numbers 123456 repeats a certain number of times in the file, say 27. So 27 is the “encrypted” key to their software.

May or may not be so.

However, I did run windump while I used the program, and didn’t see any related network traffic moving, so I figure that I’m safe and they didn’t steal my information. :slight_smile: