CiGiCiGi ViP 1.5 (b)

CiGiCiGi ViP 1.5 (b)
(Backdoor.Win32.Cigivip.15.b)
(Trojan-Dropper.Win32.Joiner.ae for join.dll)
(Trojan-PSW.Win32.Delf.ao for server.exe)

by FµNGµ§ K¡D[x]

Written in Delphi

Released in October 2002

Made in Turkey

more versions


Server:
dropped file:
c:\WINDOWS\WinSys32.exe 

size: 665.088 bytes 

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "WinSys32" 
c:\windows\system.ini, [boot] "shell" 
c:\windows\win.ini, [windows] "run"

MegaSecurity