BestPics
(Backdoor.Win32.Bestpics)

by ?

Written in Visual C++

Released in July 2002

Probably made in Germany


Server:
dropped file:
c:\WINDOWS\SYSTEM\ntss.exe 

size: 151.552 bytes 

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "NetManagerService" 

remark:
The server installs three pornographic pictures,
called "bestweek1.jpg, bestmonth1.jpg and bestday1.jpg" 

MegaSecurity