CiGiCiGi ViP 1.5 (a)

CiGiCiGi ViP 1.5 (a)
(Backdoor.Win32.Cigivip.15.a)
(Trojan-Dropper.Win32.Joiner.ae for join.dll)

by FµNGµ§ K¡D[x]

Written in Delphi

Released in October 2002

Made in Turkey


Server:
dropped file:
c:\WINDOWS\WinSys32.exe 

size: 665.088 bytes 

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "WinSys32" 
c:\windows\system.ini, [boot] "shell" 
c:\windows\win.ini, [windows] "run"

MegaSecurity