by sNiper109
Written in Visual Basic
Released in July 2007
Server:
dropped file:
c:\WINDOWS\system32\My_Server.exe
size: 287,198 bytes
added to registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Windows Update"
data: C:\WINDOWS\system32\My_Server.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{F90F0806-E0C0-EF53-B7E4-CD62C00106D0} "StubPath"
data: C:\WINDOWS\system32\My_Server.exe
tested on Windows XP
August 02, 2007
MegaSecurity