Backdoor.Win32.Delf.fn
(Backdoor.Win32.Delf.fn)

by ?

Original Filename unknown

Written in Delphi, compressed with PECompact

more in this category


Dropped file:
c:\WINDOWS\JAVA\apps\wsock32.exe 

size: 35.328 bytes 

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{9EC0745F-CAD3-628A-48E9-02B9AFEC8E74} "StubPath" 

registry added:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Hardware Profiles\Current\Software\Microsoft\windows\CurrentVersion\Internet Settings "EnableAutodial" 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders "Common Startup" 

Does try to download a file from the internet.

MegaSecurity