• Detection included into Fortinet Virus Update March 14 2003
    Firmware 2.30 AV definition 4.056
    Firmware 2.36 AV definition 4.056
  • Trojan is 32bit with a size of 69,632 bytes, and was coded using Visual Basic 6
  • Trojan requires VB6 runtime library MSVBVM60.DLL on target system in order to be a threat
  • When executed, Trojan may copy itself to the Windows folder as “SysOps.exe” and launch itself, and modify the registry in order to load at next Windows startup –
    "SysOps" = SysOps
  • Trojan will wait for the infected user to initiate MSN Messenger – if this application is run, the Trojan virus may disable all incoming messages and send a notification message to the author of the virus as an alert that the Trojan is running on the victim’s computer
  • Trojan has functionality to allow uploads to the victim’s machine and remotely execute the uploaded files as well as initiate a message flood attack against a contact listed in the MSN Messenger’s contact list of the infected user
  • The Trojan attempts to disable Task Manager application via the registry however this is not functional in Windows 98 –
    "DisableTaskMgr" = 01, 00, 00, 00
  • Trojan contains the string “M$N Corruption” in its code