Autograph 0.1
(Backdoor.Win32.Delf.s)

by Vasya Tvorojkov

Written in Delphi, compressed with UPX






dropped file:
c:\WINDOWS\msconfig.exe
size: 273,920 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "NetDde"
data: C:\WINDOWS\msconfig.exe 



tested on Windows X
October 29, 2004

MegaSecurity