Shalan 1.01
(HackTool.Win32.VB.er)
(Trojan-GameThief.Win32.Magania.amvt)

by Red Move

Written in Visual Basic, compressed with UPX

Released in February 2005

more versions 


Server:
dropped file:
c:\WINDOWS\system32\Mscng.exe
size: 13,894 bytes 

startup:
HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)"
old data: "%1" %* 
new data: Mscng.exe opext "%1" %* 



tested on Windows XP
June 01, 2005
MegaSecurity