by ItalianFamily-EGHE
Written in Delphi
Released in April 2006
Server:
dropped file:
c:\WINDOWS\Microsoft Update.exe
size: 79,789 bytes
startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "system"
data: C:\WINDOWS\Microsoft Update.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515} "StubPath"
data: C:\windows\Microsoft Update.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "system"
data: C:\WINDOWS\Microsoft Update.exe
tested on Windows XP
April 20, 2006
MegaSecurity