Winter Love 3.2

Winter Love 3.2
(Not detected by KAV on May 26, 2005)

by plunix

Written in Microsoft Visual C++

Released in March 2005

Made in China

Winter Love

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 
                                    


Server:
dropped files:
c:\WINNT\system32\LoadDll.dll  Size: 1,308 bytes 
c:\WINNT\system32\myDll.dll    Size: 69,632 bytes 

port: 3043 TCP

added to registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MYSRVSHELL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MySrvShell
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYSRVSHELL
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MySrvShell




tested on Windows 2000
May 26, 2005

MegaSecurity