by Danil
Made in Ukrainia
Server:
dropped files:
c:\WINDOWS\system32\dtr.dat size: 45 bytes
c:\WINDOWS\system32\DtrVk.dll size: 5.120 bytes
c:\WINDOWS\system32\nbsystem.dll size: 3.072 bytes
c:\WINDOWS\system32\nbsystem.exe size: 12.800 bytes
added to registry:
HKEY_CLASSES_ROOT\CLSID\{366AC379-A258-4617-B235-7916FBBBCA99}\InProcServer32 "(Default)"
data: nbsystem.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad "NBSYSTEM"
data: {366AC379-A258-4617-B235-7916FBBBCA99}
tested on Windows XP
December 26, 2004
MegaSecurity