MagicLink netPCspy 2.0 (d)

MagicLink netPCspy 2.0 (d)
(Backdoor.Win32.CmjSpy.20.d)

by cmjsoft

Written in Delphi

Released in February 2004




Server:
dropped files:
c:\WINDOWS\system32\hlicense.vxd   size: 52 bytes 
c:\WINDOWS\system32\magic.exe      size: 95.056 bytes 
c:\WINDOWS\system32\msysdll.dll    size: 84.172 bytes 
c:\WINDOWS\system32\systmdllm.vxd  size: 73 bytes 
 
port: 1982 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "MagicLinkServer"
data: magic.exe

tested on Windows XP

MegaSecurity