by Kh.CO
Written in Visual Basic
Released in July 2006
Made in Iran
Server:
dropped file:
c:\WINDOWS\Help\9112Trojan.exe
size: 17,096 bytes
startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{Y479B6D0-OTRW-U5GH-S1EE-E0AC10B4E9942119} "StubPath"
data: C:\WINDOWS\help\9112Trojan.exe -tx
tested on Windows XP
November 24, 2006
MegaSecurity