Bfpass 2.998
(TrojanDropper.Win32.VB.a)
(Backdoor.Win32.VB.bl for Benf298.exe)

by ?

Written in Visual Basic

Released in August 2002

Made in China


Abcbin.exe


Abcset.exe


Installer: BFPASS298.EXE (248.576 bytes)
extracted files: 
Abcbin.exe (48.128 bytes)
Abcset.exe (93.184 bytes)
Benf298.exe (84.480 bytes)

Servers:
c:\WINDOWS\MSBFLET2.EXE 
c:\WINDOWS\MSCVT2.EXE 
c:\WINDOWS\SYSTEM\MSBFRUN2.EXE 
c:\WINDOWS\SYSTEM\MSBFSET2.EXE 

size: 84.480 bytes 

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "MSBenCheck" 
HKEY_CLASSES_ROOT\chm.file\shell\open\command "(Default)" 
HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)" 
HKEY_CLASSES_ROOT\scrfile\shell\open\command "(Default)" 
HKEY_CLASSES_ROOT\txtfile\shell\open\command "(Default)" 
c:\windows\win.ini, [windows] "run" 

MegaSecurity