Psw yAHOO
(HackTool.Win32.VB.lc)
(Backdoor.Win32.VB.auh for Server)

by E.M.I.N.E.M

Written in Visual Basic

Released in July 2007

Made in Romania





Server:
dropped file:
c:\WINDOWS\system32\svchost32.exe
size: 118,784 bytes 

port: 8888 TCP

added to registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr"
data: 01, 00, 00, 00 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "server"
 



tested on Windows XP
July 19, 2007

MegaSecurity