Puppet Baby 1.0
(Trojan.Win32.Genome.ijj)
(Trojan-PSW.Win32.QQRob.u for Server)
(Trojan.WinREG.StartPage.g)

by Absolutely

Released in April 2007

Made in China


Server
dropped file:
c:\WINDOWS\Web\websv.com
size: 25,650 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\WebSv "StubPath"
data: C:\WINDOWS\web\websv.com 



tested on Windows XP
April 30, 2007

MegaSecurity