NastyXP 1.1 Beta 4
(Backdoor.Win32.Delf.air for Server)

by BBOYMARIO

Written in Delphi

Released in November 2005

Made in Poland

more versions


Server:
dropped file:
C:\RECYCLER\services.exe
size: 1,025,620 bytes

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"
old data: Explorer.exe 
new data: explorer.exe C:\RECYCLER\services.exe 

tested on Windows XP
November 19, 2005	

MegaSecurity