|
|
by Gargamel
Written in Visual C++
Released in August 2004
|
|
|
Server:
dropped file:
c:\WINNT\service.exe
size: 22.802 bytes
startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
data: C:\WINNT\service.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4DA6578A-5EE1-3CA3-3AA1-4E6B1A2C6C1D} "StubPath"
data: C:\WINNT\service.exe 2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
data: C:\WINNT\service.exe
tested on win2000
MegaSecurity