AIMVision [NextGen] 1.4
(Backdoor.Win32.AIMVission.14)

by Tako

Written in Visual Basic, compressed with Petite

Released in April 2003

more versions


Server:
c:\WINDOWS\SYSTEM\win32hlp.exe 

size: 41.984 bytes 

port: 4881, 5885 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Windows Runtime Help" 
HKEY_CLASSES_ROOT\Windows Runtime Help 4.881.1208\shell\open\command "(Default)" 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "win32hlp" 

added file:
c:\WINDOWS\SYSTEM\WinRunHelp.wrh 

added keys:
HKEY_CLASSES_ROOT\.wrh 
HKEY_CLASSES_ROOT\Windows Runtime Help 4.881.1208\shell\open\command 

MegaSecurity