CRShell 1.2
(not-a-virus:RemoteAdmin.Win32.CRShell.10)
(not-a-virus:RemoteAdmin.Win32.CRShell.12)

by XpyXt

Written in Microsoft Visual C++

Released in February 2004

more versions


Release Versión  	1.2
Versión 	Sistemas
Servidor 	1.2 	Microsoft Windows 2000 y Windows 2003
Cliente 	1.0 	Microsoft Windows [98, ME, 2000, XP, NT, 2003], Linux
Editor 	    1.0 	Microsoft Windows [98, ME, 2000, XP, NT, 2003], Linux

XpyXt 
 

Server:
dropped file:
c:\WINNT\system32\server.exe

size: 36.924 bytes

port: 12345 TCP (example}
 
added to registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BLABLA\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\blabla\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\blabla\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BLABLA\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BLABLA\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\blabla\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\blabla\Security

tested on win2000
MegaSecurity