by -/SHA\-
Written in Delphi
Released in November 2005
Server: dropped file: c:\WINDOWS\system32\wdImgr.exe size: 797,858 bytes port: 9500 TCP startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run "SVCHOST" data: C:\WINDOWS\System32\wdImgr.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "wdImgr.exe" data: C:\WINDOWS\System32\wdImgr.exe tested on Windows XP December 03, 2005MegaSecurity