Sepro (d)
(Backdoor.Win32.Sepro.d)

by ?

Written in C

more versions


dropped files:
c:\WINDOWS\system32\gus.ini    Size: 1,881 bytes 
c:\WINDOWS\system32\srvcp.exe  Size: 27,138 bytes 

port: 113 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Service Profiler"
data: srvcp.exe 

attempts to connect to an IRC Server


tested on Windows XP
February 28, 2005

MegaSecurity