Goy FTP
(Trojan.Win32.SmallShare)
(not-a-virus:Server-FTP.Win32.Serv-U.243)

by Hacktarus Corp

Released in December 1999


Server:
dropped files:
c:\WINDOWS\SYSTEM\Cmmlo32.exe     Size: 823.596 bytes 
c:\Win386.txt 
c:\WINDOWS\shame.exe 
c:\WINDOWS\SYSTEM\GOYZ_IP.TXT 
c:\WINDOWS\SYSTEM\infsys.ini 

port: 25123 TCP

added to registry: 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "(Default)" 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Network\LanMan\C$ 


MegaSecurity