|
|
by Gargamel
Written in Visual C++
Released in August 2004
|
|
|
Server:
dropped file:
c:\WINNT\server.exe
size: 22.804 bytes
startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
data: C:\WINNT\server.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AED1C65-4C6B-6A7E-0B2D-6B124E5C705A} "StubPath"
data: C:\WINNT\server.exe 2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
data: C:\WINNT\server.exe
tested on win2000
MegaSecurity