Dewin (f)
(Backdoor.Win32.Dewin.f)

by ?

Compressed with PECompact

more versions


dropped file (Windows XP):
c:\Documents and Settings\%user%\Local Settings\Temp\temp.bat
size: 281 bytes 

dropped files (Windows 98):
c:\WINDOWS\Asfwin.sys    Size: 58 bytes 
c:\WINDOWS\Winreg.exe    Size: 37.376 bytes 

startup (Windows 98):
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "SystemReg"
data: C:\WINDOWS\WINREG.EXE run 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "SystemReg"
data: C:\WINDOWS\WINREG.EXE run 

tested on Windows XP & 98
November 22, 2005

MegaSecurity