AIMVision [NextGen] 1.4 (b)

AIMVision [NextGen] 1.4 (b)
(Backdoor.Win32.AIMVision.14.a)
(Backdoor.Win32.AIMVision.14.b)
(Backdoor.Win32.AIMVision.14.e)
(Backdoor.Win32.AIMVision.14.g)
(Backdoor.Win32.AIMVision.14.j)
(Backdoor.Win32.AIMVision.14.i)

by Tako

Written in Visual Basic, compressed with Petite

Released in April 2003

more versions


Server:
dropped files:
c:\WINDOWS\SYSTEM\w2d7win.exe     size: 10.000 bytes 
c:\WINDOWS\SYSTEM\win32hlp.exe    size: 45.725 bytes 
c:\WINDOWS\SYSTEM\WinRunHelp.wrh  size: 4 bytes 


port: 4881, 5885 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "win32hlp"
data: C:\WINDOWS\SYSTEM\win32hlp.exe 

HKEY_CLASSES_ROOT\Windows Runtime Help 4.881.1208\shell\open\command "(Default)"
data: C:\WINDOWS\SYSTEM\win32hlp.exe

MegaSecurity