QQRein 3.1
(Trojan-PSW.Win32.QQPass.fb)

by ReinSoft

Written in Delphi

Released in November 2005

Made in China

more versions


dropped file:
c:\WINDOWS\system32\svchoxt.exe
size: 36,652 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "SysDesk"
data: C:\WINDOWS\System32\svchoxt.exe [System Process]@ # [SYSTEM PROCESS]` QQ.Et # [System Process]� # [SYSTEM PROCESS]� QQ.E� Syst� Syst� SYST



tested on Windows XP
December 26, 2005

MegaSecurity