BLOGFA-PS 1.1
(Not detected by KAV on March 22, 2008)

by Hosein Jam

Written in Visual Basic

Released in September 2007

Made in Iran




Server
c:\WINDOWS\system32\mswin.exe
Size: 36,940 bytes 	

Added to Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "nod32kui"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "System"

	
Tested on Windows XP
January 22, 2008

MegaSecurity