.: Magic PS 1.42 :.
Released 18 years, 5 months ago. Jan 2004
By magic_h2001::actions

Additional Details
- From: Iran
- Coded by: magic_h2001
- Version: Magic PS 1.42
- Released date: Jan 2004, 18 years, 5 months ago.
- Coded in: Delphi
- Family: Magic PS
- Category: Information Stealer
MegaSecurity Notes
Server: dropped files: c:\WINDOWS\spoolsvr.exe size: 11.500 bytes c:\WINDOWS\SYSTEM\FlashPlayer32.exe size: 11.500 bytes registry added: HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{142A6800-3I18-11C0-821H-4M4GICH20010S} "StubPath" data: C:\WINDOWS\SYSTEM\FlashPlayer32.exe
Author Words
-------------- Magic-PS v1.42 -------------- 1.Hidden from MsConfig ;) 2.Added Disable Task Manager in XP and 2k if victim press Ctrl+Alt+Del.. can not open TaskManager. 3.Added Disable Registry Editor (RegEdit). 4.Added Disable Y! save password and auto login. 5.Added auto remove older versions of MPS from victim's system. 6.Added Delete yahoo! Messenger Massages Archive after send logs!. victim can not find your ID in messages archive. 7.Added choose icon for MPS creator. magic_h2001
URL's and mails were automatically redacted (filtered) for reader's safety. However the filter is not perfect and can't find all harmful elements. If you find something dangerous including file link, website, mail address, profanity... contact me immediately at sub7crew@protonmail.com, thank you in advance.