by MaLy
Written in Delphi
Released in May 2006
Made in Poland
Server: dropped file: c:\WINDOWS\svchost.exe Size: 4,378,112 bytes port: 14920, 21 TCP added to registry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools" data: 01, 00, 00, 00 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "svchost" data: C:\Windows\svchost.exe HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List "C:\Windows\svchost.exe" data: C:\Windows\svchost.exe:*:Enabled:svchost tested on Windows XP May 17, 2006MegaSecurity