THC
(Backdoor.Win32.THC)

by ?

Server Only

Written in Visual Basic


dropped file:
C:\WINDOWS\SYSTEM\Flying.scr 

size: 60 KB

port: 3003 TCP

startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run 
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices 
c:\windows\win.ini, "open" 


MegaSecurity