by Behzad
Written in Visual Basic
Released in January 2005
Made in Iran
Server:
dropped files:
c:\WINDOWS\svchost.exe Size: 12,289 bytes
c:\WINDOWS\system32\Init32.exe Size: 12,289 bytes
startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6M8A6G00-3I18-5-24-1360} "StubPath"
data: C:\WINDOWS\system32\Init32.exe
tested on Windows XP
November 21, 2005
MegaSecurity