by ToxicFrog
Written in Visual Basic
Released in June 2005
Made in Iran
Server:
dropped file:
c:\WINDOWS\Help\1929SVCHOST.EXE
size: 14,488 bytes
startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E9941929}
tested on Windows XP
September 16, 2005
MegaSecurity