by Behzad
Written in Visual Basic
Released in February 2005
Made in Iran
Server:
dropped files:
c:\WINDOWS\Help\svchost..exe
size: 12,801 bytes
c:\WINDOWS\inf\Init32.exe
size: 12,801 bytes
startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6M8A6G00-3I18-5-24-1360} "StubPath"
data: C:\WINDOWS\inf\Init32.exe
tested on Windows XP
November 20, 2005
MegaSecurity