Written in Visual Basic

Made in China

dedao

mima

Backdoor.Win32.VB.wr (mima):
size: 28,672 bytes

port: 1979, 31797 TCP

startup: none

url http://www.safefan.com can be found in the binary

tested on Windows 2000
April 05, 2005