Magic PS 1.5 SE
(Trojan-Spy.Win32.Delf.dd)

by magic_h2001

Written in Delphi

Released in July 2004

Made in Iran

more versions


----------------
Magic-PS v1.5 SE
----------------
{{ Second Edition }}
released in 30/07/2004

 + Full Supporting win 9x-me-nt-2k-xp-2k3 and LongHorn.
 + Fixed for all languages of yahoo messenger (Chines - Arabic - italic and more....).
 + Fixed for all Versions of yahoo messenger 5x-6x
 + change sender Icon from (jpg or software) to (None icon) after install.
 + Send Windows user name.
 + Send Computer name.
 + EnCode Pass :
   if victim uses Alt+key or Html Codes or Space or Smileys in password you must 
   select this item to Encoding password and when you receive EnCoded password 
   use MPS-Decoder for Decoding password...
 + auto remove older versions of MPS from victim's system.
 + MPS Sender Kernel Coded again in Win32ASM and fastest.....
 - Some Bugs Fixed...
	   
magic_h2001	   


Server:
dropped files:
c:\WINNT\regsvr.exe               size: 14.728 bytes 
c:\WINNT\system32\Tapi32init.dll  size: 3.072 bytes 
c:\WINNT\system32\Tapi32init.exe  size: 14.728 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6M8A6G00-3I18-11C0-821H-444200140P0S} "StubPath"
data: C:\WINNT\system32\Tapi32init.exe 

tested on Win2000

MegaSecurity