Written in Visual Basic

Made in Germany

more versions

fake error message

dropped files:
c:\WINDOWS\loginui32.exe  Size: 53,248 bytes 
c:\WINDOWS\netcruz.log    Size: 958 bytes 

port: 50305 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "loginui32"
data: C:\WINDOWS\loginui32.exe 

attempt to download a file from the following Web sites
http://www.geocities.com/hazzelten/logonui32.bin
http://www.geocities.com/peter0xf0rd/logonui32.bin



tested on Windows XP
March 29, 2005