Devil 6 (b)
(Backdoor.Win32.Devildor.6.b)

by Sforever

Invisible telnetserver

Written in Delphi

Released in February 2004

Made in China

more versions


Server:
size: 68.608 bytes

registry added:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Userinit" 
data: C:\WINDOWS\SYSTEM\userinit.exe

dropped files:
c:\WINDOWS\mseditcpl.exe 
c:\WINDOWS\services.exe 
c:\WINDOWS\wmmli_32.dll 

MegaSecurity