Spion 3.5.5.15
(Not detected by KAV on February 17, 2008)
(not-a-virus:Monitor.Win32.Dafunk for HkLib.dll)

by CBogdan

Written in Delphi

Released in August 2002

Made in Rumania


Server:
size: 188.416 bytes

port: 1981, 1982 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "logger" 

added:
c:\WINDOWS\comcgi.srg 
c:\WINDOWS\mcgi.ini 

MegaSecurity