Hot Girls Trojan
(Worm.Win32.AutoRun.rye)

by Kpdo

Written in Delphi

Released in November 2008

Made in Brazil





Server
Dropped File:
c:\WINDOWS\system32\ctfmons.exe.exe
Size: 576,512 bytes 

Added to Registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "ctfmons.exe"
Data: C:\WINDOWS\system32\ctfmons.exe 



Tested on Windows XP
January 15, 2009
July 27, 2007

MegaSecurity