Win Invader 1.0.2
(Trojan.Win32.VB.bha)

by ?

Released in May 2007

Made in Brazil




Server:
dropped file:
c:\WINDOWS\system\msmsgr.exe
size: 49,152 bytes 

port: 1981 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "msmsgr"
data: C:\Windows\System\msmsgr.exe 



tested on Windows XP
June 07, 2007

MegaSecurity