.: Magic PS 1.5 SE++ :.

Additional Details

• From: Iran
• Coded by: magic_h2001
• Version: Magic PS 1.5 SE++
• Released date: Sep 2004, 16 years, 10 months ago.
• Coded in: Delphi
• Family: Magic PS
• Category: Information Stealer

MegaSecurity Notes

Server:
dropped files:
c:\WINDOWS\REGSVR.EXE                 Size: 14,682 bytes 
c:\WINDOWS\system32\Tapi32init.exe    Size: 14,682 bytes 

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6M8A6G00-3I18-11C0-821H-444200140P0S} "StubPath"
data: C:\WINDOWS\System32\Tapi32init.exe 



tested on Windows XP
October 18, 2005

Author Words

------------------
Magic-PS v1.5 SE++
------------------
{{ Second Edition Plus Plus }}
released in 30/09/2004

 + Now MPS can work in limited (Restricted) windows users. ( ex: in CafeNets systems )
 + Add Disable Regedt32 in disable Regedit item.
	   
magic_h2001