H-PS 1.0
(Trojan-PSW.Win32.Yahoo.VB.p)

by Hossein Hacker

Written in Visual Basic

Released in May 2008

Made in Iran


Server
Dropped File:
c:\WINDOWS\system32\Sys32.exe
Size: 60,047 bytes 

Added to Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Update"
Data: C:\WINDOWS\system32\Sys32.exe 




Tested on Windows XP
June 04, 2008

MegaSecurity