FirstFantasy Beta 1.3
(Backdoor.Win32.Prosti.am for Server)

by Amoeba

Released in January 2007

Made in China

more versions


Server
Dropped Files:
c:\WINDOWS\system32\F_Server.dll    Size: 130,048 bytes 
c:\WINDOWS\system32\F_Server.exe    Size: 85,504 bytes  

Added to Registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_FIRSTFANTASY_SERVICE\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FirstFantasy_Service\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FirstFantasy_Service\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_FIRSTFANTASY_SERVICE\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirstFantasy_Service\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirstFantasy_Service\Security




Tested on Windows XP
January 14, 2008

MegaSecurity