Guangwai Girl 1.53A (c)
(Backdoor.Win32.GWGirl.153.c)

by Guangwai

Compressed with ASPack

Released in February 2002

Made in China

more versions


Server:
dropped files:
c:\WINNT\system32\DIAGCFG.EXE   size: 100.352 bytes 
c:\WINNT\system32\MSIESMTP.DLL  size: 18.432 bytes 

port: 6267 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices "Diagnostic Configuration"
data: C:\WINNT\system32\DIAGCFG.EXE 

HKEY_CLASSES_ROOT\comfile\shell\open\command "(Default)"
old data: "%1" %* 
new data: C:\WINNT\system32\DIAGCFG.EXE "%1" %* 


HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)"
old data: "%1" %* 
new data: C:\WINNT\system32\DIAGCFG.EXE "%1" %* 

MegaSecurity