Mowalker

dropped files:
c:\WINDOWS\system32\cp_24467.nls    Size: 92 bytes 
c:\WINDOWS\system32\msvcrt60.exe    Size: 131,072 bytes 
c:\WINDOWS\system32\wins32x.bin     Size: 33,350 bytes 
c:\WINDOWS\system32\wins32x.dll     Size: 109,056 bytes 

added to registry:
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run "msvcrt60.exe"
data: C:\WINDOWS\System32\msvcrt60.exe 

HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run "msvcrt60.exe"
data: C:\WINDOWS\System32\msvcrt60.exe 

HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run "msvcrt60.exe"
data: C:\WINDOWS\System32\msvcrt60.exe 

HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run "msvcrt60.exe"
data: C:\WINDOWS\System32\msvcrt60.exe 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "msvcrt60.exe"
data: C:\WINDOWS\System32\msvcrt60.exe 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices "msvcrt60.exe"
data: C:\WINDOWS\System32\msvcrt60.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "msvcrt60.exe"
data: C:\WINDOWS\System32\msvcrt60.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices "msvcrt60.exe"
data: C:\WINDOWS\System32\msvcrt60.exe 

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_RASMAN\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TAPISRV\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\C
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RASMAN\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TAPISRV\0000\Control	



tested on Windows XP
May 03, 2005