Netsys VIP
(Backdoor.Win32.GrayBird.bi)
(Trojan-Spy.Win32.Delf.ii)

by Zhou Jian

Written in Delphi

Released in June 2005

Made in China

more versions


Server:
dropped file:
c:\Program Files\NetMeeting\Winservices.exe
size: 396,860 byte

port: 2374 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "application"
data: C:\Program Files\NetMeeting\Winservices.exe  




tested on win2000
July 07, 2005

MegaSecurity