.: Toxic-CV 0.5 :.

Additional Details

• Coded by: Toxic_Frog
• Version: Toxic-CV 0.5
• Released date: Feb 2005, 17 years, 7 months ago.
• Coded in: Visual Basic
• Family: Toxic-CV 0.5
• Category: Destructive

MegaSecurity Notes

Server:
dropped file:
c:\WINDOWS\SVCHOST.EXE
size: 10,215 bytes 

added to registry:
HKEY_USERS\S-1-5-21-789336058-1957994488-1060284298-1003_Classes\exefile\DefaultIcon "(Default)"
data: %1 

HKEY_USERS\S-1-5-21-789336058-1957994488-1060284298-1003_Classes\exefile\Shell\Open\Command "(Default)"
data: C:\WINDOWS\SVCHOST.EXE %1 %* 

HKEY_CURRENT_USER\Software\Classes\exefile\DefaultIcon "(Default)"
data: %1 

HKEY_CURRENT_USER\Software\Classes\exefile\Shell\Open\Command "(Default)"
data: C:\WINDOWS\SVCHOST.EXE %1 %* 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system "DisableRegistryTools"
data: 01, 00, 00, 00 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system "DisableTaskMgr"
data: 01, 00, 00, 00 

HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)"
old data: "%1" %* 
new data: C:\WINDOWS\SVCHOST.EXE %1 %* 



tested on Windows XP
September 10, 2005