by sNiper109
Written in Visual Basic
Released in July 2007
Server:
dropped file:
c:\WINDOWS\system32\My_Server.exe
size: 287,138 bytes
added to registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Windows Update"
data: C:\WINDOWS\system32\My_Server.exe
HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Windows Update\Windows Update
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{F00000F8-EED0-E175-CDFC-D084D0230802}
tested on Windows XP
July 31, 2007
MegaSecurity