.: Magic PS 1.42 :.

Additional Details

• From: Iran
• Coded by: magic_h2001
• Version: Magic PS 1.42
• Released date: Jan 2004, 18 years, 10 months ago.
• Coded in: Delphi
• Family: Magic PS
• Category: Information Stealer

MegaSecurity Notes

Server:
dropped files:
c:\WINDOWS\spoolsvr.exe               size: 11.500 bytes 
c:\WINDOWS\SYSTEM\FlashPlayer32.exe   size: 11.500 bytes

registry added:
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{142A6800-3I18-11C0-821H-4M4GICH20010S} "StubPath" 
data: C:\WINDOWS\SYSTEM\FlashPlayer32.exe

Author Words

--------------
Magic-PS v1.42
--------------
1.Hidden from MsConfig ;)
2.Added Disable Task Manager in XP and 2k
  if victim press Ctrl+Alt+Del.. can not open
  TaskManager.
3.Added Disable Registry Editor (RegEdit).
4.Added Disable Y! save password and auto login.
5.Added auto remove older versions of MPS from 
  victim's system.
6.Added Delete yahoo! Messenger Massages Archive
  after send logs!. victim can not find your ID in 
  messages archive.
7.Added choose icon for MPS creator.
	   
magic_h2001