Guangwai Girl 2.5
(Backdoor.Win32.GWGirl.25)

by Guangwai

Compressed with ASPack

Released in February 2002

Made in China

more versions


Server:
dropped file:
c:\WINDOWS\system32\Rundll.exe
size: 18,432 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices "(Default)"
data: Rundll.exe powrprof.dll,LoadCurrentPwrScheme 



tested on Windows XP
February 03, 2005

MegaSecurity