TrojanC 2005
(Backdoor.Win32.Agent.ld)
(Trojan-Dropper.Win32.Agent.po)

by seven-eleven

Released in June 2005

Made in China

more versions





Server:
dropped file:
c:\WINNT\system32\R_Server.exe
size: 32,768 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "IExplore"
data: C:\WINNT\system32\R_Server.exe 



tested on Windows 2000
August 19, 2005

MegaSecurity