Armageddon v3
(Not detected by KAV on February 22, 2008)

by KOrUPt

Written in C++

Released in December 2006

more versions


HOW TO USE IT: 
			  When you first connect to the server you will be asked for a password,  password is used by default,
			just type anything and it should continue, however, if someones changed the password you will 
			no longer be able to accses the server unless you know it, if you turn the password feature off
			then it will stay off untill the server is closed and re-opened...	
			
KOrUPT			


Server:
size: 523,556 bytes

dropped files:
c:\WINDOWS\CoreSP.ini
size: 117 bytes 

port: 1992 TCP

added to registry:
HKEY_CLASSES_ROOT\batfile\shell\open\command "(Default)"
data: (data too large: 260 bytes) 

HKEY_CLASSES_ROOT\comfile\shell\open\command "(Default)"
data: (data too large: 260 bytes) 

HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)"
data: (data too large: 260 bytes) 

HKEY_CLASSES_ROOT\htafile\Shell\Open\Command "(Default)"
data: (data too large: 260 bytes) 

HKEY_CLASSES_ROOT\piffile\shell\open\command "(Default)"
data: (data too large: 260 bytes) 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Syslistbox"
data: Crspacker.exe



tested on Windows XP
December 02, 2006

MegaSecurity