by Case
Written in Visual Basic
Released in May 2002
Server: dropped files: C:\WINDOWS\MsUpdate.exe c:\WINDOWS\SYSTEM\MsUpdate.exe size: 936 KB port: 23, 6556 TCP startup: HKCU\Software\Microsoft\Windows\CurrentVersion\Run "MsUpdate" HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices "windows"MegaSecurity