by Ayoob. N
Written in Visual Basic
Released in July 2006
Server:
Dropped Files:
c:\WINDOWS\sysver.exe Size: 24,829 bytes
c:\WINDOWS\system32\syschost.exe Size: 24,829 bytes
Startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"
Data: Explorer.exe syschost.exe s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{402518Q5F0-YAC2OL-O4KGD-S16T4-MOIS89D1O702} "StubPath"
Data: sysver.exe
Tested on Windows XP
April 05, 2008
MegaSecurity