NetMonitor 3.0 (build 020311)
(Backdoor.Win32.Netspy.20.i)

by Tiger Liu

aka NetSpy

Written in Microsoft Visual C++

Released in March 2002

Made in China

more versions


Server:
dropped files:
c:\WINDOWS\SYSTEM\netspy.exe     size: 385.024 bytes 
c:\WINDOWS\SYSTEM\NETSPYHKS.DLL  size: 36.864 bytes 
 
port: 7306, 7389 TCP

added to registry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "netspy"
data: netspy.exe 

tested on Windows 98
December 10, 2004

MegaSecurity