PalSpy
(Not detected by KAV on November 16, 2006)

by ?

Written in Visual Basic

Released in May 2004

more versions




dropped files:
c:\Program Files\ABC\Kazaa.exe                   size: 81.920 bytes 
c:\Program Files\ABC\_Root\image.jpg             size: 43.255 bytes 
c:\Program Files\ABC\_Root\index.html            size: 3.300 bytes 
c:\Program Files\ABC\_Root\Thumbs.db             size: 12.800 bytes 
c:\Program Files\ABC\_Root\page\email.html       size: 822 bytes 
c:\Program Files\ABC\_Root\page\filemanager.html size: 479 bytes 
c:\Program Files\ABC\_Root\page\image.html       size: 778 bytes 
c:\Program Files\ABC\_Root\page\image1.html      size: 586 bytes 
c:\Program Files\ABC\_Root\page\main.html        size: 584 bytes 
c:\Program Files\ABC\_Root\page\openwindows.html size: 592 bytes 
c:\Program Files\ABC\_Root\page\password.html    size: 511 bytes 
c:\Program Files\ABC\_Root\page\processes.html   size: 484 bytes 
c:\Program Files\ABC\_Root\page\readroompm.html  size: 522 bytes 
c:\WINNT\system32\PicFormat32.dll                size: 121.562 bytes 	
	
port: 8080 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Kazaa"
data: C:\PROGRA~1\ABC\kazaa.exe

tested on Windows XP

MegaSecurity