Written in Visual Basic

Released in September 2004

Made in Iran

Server:
dropped file:
c:\WINDOWS\NDDEN.exe
size: 23,567 bytes 

added to registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "disableregistrytools"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Microsoft PCHealth32"
data: NDDEN.exe 
	
	
	
tested on Windows XP
November 07, 2005