Heres what the Symantic website had to say about this trojan Targeting over 400 banks and having the ability to circumvent two-factor authentication are just two of the features that push Trojan.Silentbanker into the limelight. The scale and sophistication of this emerging banking Trojan is worrying, even for someone who sees banking Trojans on a daily basis. This Trojan downloads a configuration file that contains the domain names of over 400 banks. Not only are the usual large American banks targeted but banks in many other countries are also targeted, including France, Spain, Ireland, the UK, Finland, Turkeythe list goes on. The ability of this Trojan to perform man-in-the-middle attacks on valid transactions is what is most worrying. The Trojan can intercept transactions that require two-factor authentication. It can then silently change the user-entered destination bank account details to the attacker's account details instead. Of course the Trojan ensures that the user does not notice this change by presenting the user with the details they expect to see, while all the time sending the bank the attacker's details instead. Since the user doesnÂt notice anything wrong with the transaction, they will enter the second authentication password, in effect handing over their money to the attackers. The Trojan intercepts all of this traffic before it is encrypted, so even if the transaction takes place over SSL the attack is still valid. Unfortunately, we were unable to reproduce exactly such a transaction in the lab. However, through analysis of the Trojan's code it can be seen that this feature is available to the attackers. The Trojan does not use this attack vector for all banks, however. It only uses this route when an easier route is not available. If a transaction can occur at the targeted bank using just a username and password then the Trojan will take that information, if a certificate is also required the Trojan can steal that too, if cookies are required the Trojan will steal those. In fact, even if the attacker is missing a piece of information to conduct a transaction, extra HTML can be added to the page to ask the user for that extra information. (In the example below the user is asked to enter their encryption key, in addition to the regular information.) Here is the login form viewed on a clean machine: (Insert Picture of a Regular Log In Screen) Below the form presented to an infected user is shown, the input box added by the Trojan has been marked in red: (Insert Picture of an Infected Log In Screen) When instructed, the Trojan can also redirect users to an attacker-controlled server instead of the real bank in order to perform a classic man-in-the-middle attack. Currently there is only one bank targeted in this way; however, recent updates to the Trojan change the user's DNS settings to point to an attacker-controlled server. Using this technique the Trojan can start redirecting any site to an attacker site at any time. This feature could also mean that if the Trojan is removed but the DNS settings are left unchanged then the user may still be at risk. (See below for the attackers' DNS server addresses.) Add to all of the above the ability to steal FTP, POP, Web mail, protected storage, and cached passwords and then we start to see the capabilities of this Trojan. But, it doesnÂt stop there  don't forget the porn! The Trojan also contains over 600 pornographic Web site URLs that can be shown to the infected user so that the attacker can make money from the referrals. Lastly, the Trojan can also download updates, which it regularly does. It can also download other executables and it can use the infected machine as a proxy or as a Web server on any chosen port (in tests the http port used was 18102). The multiple configuration files that the Trojan downloads are updated several times per day and currently the Trojan is capable of injecting HTML into about 200 different URLs. The configuration files are compressed and encrypted; however, after decrypting them we can see how the Trojan works in more detail. The configuration files are structured as .ini files and each section of an .ini file represents a different task. Here is a snippet from the configuration file that was used to inject HTML into the banking form shown in the example above: jhw21] pok=insert qas=someBankSite.com/xpage/loginxxxxxxxxxs.htm njd=name="oppasswd; dfr=14 xzn=/)n xzq=2 rek=(div class="clear sep4")(/div) (label for="clave")Clave de firma: (/label) (input name="ESpass" type="password" size="8" maxlength="8" class="input01 aleft w180"/) req=166 The configuration options in the snippet above are as follows: Token: Purpose: pok Action to take qas URL to take action on njd String to search for xzn End string to search for rek HTML to insert The Trojan searches for the string name="oppasswd; then it finds the end tag /) then it inserts the string into the page: (div class="clear sep4")(/div) (label for="clave")Clave de firma: (/label) (input name="ESpass" type="password" size="8" maxlength="8" class="input01 aleft w180"/) Shown below is the HTML shown to the user on a non-infected computer: (label for="clave")Clave personal: (/label) (input id="clave" name="oppasswd" type="password" size="8" maxlength="8" class="input01 aleft w180"/) (/div) And on an infected computer: (label for="clave")Clave personal: (/label) (input id="clave" name="oppasswd" type="password" size="8" maxlength="8" class="input01 aleft w180"/) (div class="clear sep4")(/div) (label for="clave")Clave de firma: (/label) (input name="ESpass" type="password" size="8" maxlength="8" class="input01 aleft w180"/) (/div) Note: I substituted ) for > in the above examples. The Trojan can take any of the following actions when altering the HTML of a page: insert, delete, replace, and replace all. The Trojan uses the keyword "ESpass" (see the form above) as a keyword when the user sends a page to the bank and the Trojan checks if the page contains that keyword. Using this technique the Trojan can recognize pages it has altered and can extract the relevant data from the page and send it to the attacker as well as to the bank. The configuration files for this Trojan currently contain over 200kb of data; however, new URLs and HTML are being added to the configuration files on a daily basis. The Trojan is easily updated since the full HTML of any banking-related Web site is sent to the attackers. Using these submissions they can target banks for which they do not have bank accounts already. We are currently monitoring all of the updates to this Trojan. The Trojan accesses the following URLs for configuration, updates, and to send stolen data:  iloveie.info  webcounterstat.info  microcbs.com  reservaza.com  screensaversfor-fun.com  mystabcounter.info  85.255.119.218 The Trojan also downloads a copy of Trojan.Flush.J, which changes the users DNS settings to the following attacker settings:  85.255.116.133  85.255.112.87 For protection, please keep your antivirus definitions up to date and block the above addresses at the firewall. Note: Not only did this Trojan grab my attention for obvious reasons, but the Trojan also installed itself as a .midi driver, causing my music to stop! For the record, the Trojan adds itself the following registry key so that it is loaded in all applications that use sound: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\"midi1 But it also said this: Discovered: December 17, 2007 Updated: January 8, 2008 12:54:17 PM Also Known As: Spy-Agent.cm [McAfee] Type: Trojan Infection Length: 54,189 bytes and 98,304 bytes Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP Trojan.Silentbanker is a Trojan horse that records keystrokes, captures screen images, and steals confidential financial information to send to the remote attacker. Protection Initial Rapid Release version December 17, 2007 revision 023 Latest Rapid Release version January 10, 2008 revision 023 Initial Daily Certified version December 17, 2007 revision 032 Latest Daily Certified version January 15, 2008 revision 016 Initial Weekly Certified release date December 19, 2007 Click here for a more detailed description of Rapid Release and Daily Certified virus definitions. Threat Assessment Wild Wild Level: Low Number of Infections: 0 - 49 Number of Sites: 0 - 2 Geographical Distribution: Low Threat Containment: Moderate Removal: Easy Damage Damage Level: Medium Payload: Records keystrokes and captures screen images Releases Confidential Info: Steals confidential financial information Distribution Distribution Level: Low

Have you tried Etsy? There are quite a few people who sell them on there. Frankly, it'd probably be cheaper to buy off there than try to make your own, once you figure in the cost of materials. My late MIL got some for her boots for her sons wedding, but I don't know where she got them. They were along the lines of what you'd posted, but had some charms on the outside. Good luck with your search.

Hi All! Yes, I am begining to re-understand about particular style homes. There had been a beautiful mid century modern ranch in our area for sale a few years ago that needed sprucing up inside to bring it back to it's original 50's grandure. The architect on the outside was just amazing! I know the price started high due to it being so unusual. I guess the owner and REagent thought there was a market for it in "Colonial Haven". Well it sat there for ever and the price just kept on dropping. Had I not moved to were I am I might have considered it at the fire sale price it was even though it was too small for us. I also remember a Frank Lloyd Wright ranch home for sale in lower Farfield Co., CT, just after we bought our home. That had a tough time selling (his rooms are pretty small). It wasn't going anywhere until the agent realized he had to specialize the advertising and target the correct buyers. I forgot how long it was on the market and what it eventually sold for though. Thank you all for reminding me that I DO have something different and not everyone is as enamoured with a ranch as I am. I guess you might say "Ranch people are a rare breed!!!!" ;) Well, back to my boxing and sprucing!! One thing I was happy about though was none of the agents thought we needed staging and were happy with the way I decorated (it did take me till this move to finally find my style!). Felt really great about that since when we were selling our last home (THE COLONIAL!) the word "dated" came around a few time and I cringed! We ripped out perfectly good wall to wall and painted brown trim white. Funny thing, I had a brief though of doing that from the begining when we first bought the house, but the carpeting was in wonderful shape, plus I am from the wall to wall generation and I really did find it to be warm and comfortable, ( an aside for the younger generation - growing up the the 50's hard wood floors ment your family was poor since only the well off people had wall to wall, plus it did make your home feel warmer and you didn't have to deal with all those dust bunnies!!!) and the brown molding was great because all you had to do was dust it, there was no upkeep! As soon as we ripped out the carpet, had the floors sanded and painted the trim, the house looked amazing and we kicked ourselves for not doing it earlier. (hence I now am with it and have beautifully sanded wood floors, area carpets and white trim!)

Both DD's and Drew and I were out shopping the city wides today. DD got a couple of the UnderArmour shirts for Hunter for $3 each. Just like new, they are $30 a piece she said! She got a like new pair of skater jeans for Hunter for another $3, still look as dark as the day they were bought home from the store. Drew got some toys and Minnesota Twins cap and a new John Deere long sleeved shirt. Madison and I went later in the morning once she came up, she found a cute red and black jumper with red turtle neck shirt for $5, two pair of boots for $4 each, a pair of hot pink sequinned tennie's for a buck and a new book, oh a pink Minnesota Twin's hoodie too. I found 2 square tray type pictures from At Home America, both coffee themed and I have coffee things in my kitchen and dining room they were $1 each so I was happy. I love going to sales, sometimes I hit it big and sometimes not. Today wasn't one of the better days...but we had fun.