Yahoo Spy Final Build 2004
(Constructor.Win32.YahooSpy.a)
(Backdoor.Win32.Delf.mb)

by MEHRDAD

Written in Delphi

Released in August 2005

more versions 


dropped file:
c:\Documents and Settings\%user%\kxz.sys
size: 25,460 bytes 

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run "VirtualHostDriver"
data: rundll32 C:\DOCUME~1\%user%\kxz.sys,StartService /IM /UI 



tested on Windows XP
November 07, 2005
MegaSecurity