Simon
(Backdoor.Win32.Simon)

by ?

Compressed with WWPack32

Released in April 2002




Server:
dropped file:
c:\WINDOWS\netpopup.exe 

size: 39.424 bytes 

port: 1981 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "NetworkPopup" 

MegaSecurity