by sNiper109
Written in Visual Basic
Released in July 2007
Server:
dropped file:
c:\WINDOWS\system32\My_Server.exe
size: 287,138 bytes
added to registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Windows Update"
data: C:\WINDOWS\system32\My_Server.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{F90F0807-EEC0-EF54-B8E4-CD73C00106D0} "StubPath"
data: C:\WINDOWS\system32\My_Server.exe
tested on Windows XP
August 08, 2007
MegaSecurity