Eraser
(Backdoor.Win32.VB.ti)

by Splinter

Written in Visual Basic

Released in May 2004


Eraser.
Eraser is a simple program that allows tohe user to connect to the server and remotley erase everything on the
server computer, and after it finishes this, the keyboard and mouse are blocked, the screen is turned black and 
it type on the screen "You've just been erased" 
-Nice little extra.
The server when executed copies itself to windows and makes itsef a hidden file. 
Registry entires are made ensuring the program loads up with windows.
Simply run the client and type in the IP Address of the computer running the server and click the Connect button.
Two options appear, disarm and detonate bith self-explanatory.
Server also installs MSWINSOCK.OCX to the infected computer meaning 
that this file does not have to be transfered and the server will work
Very small client and server.  
Cheers.
Splinter


Server:
dropped files:
c:\WINDOWS\mswinsock.OCX  size: 108.336 bytes 
c:\WINDOWS\root.exe       size: 104.236 bytes 

port: 871 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "Root"
data: ROOT.EXE 

MegaSecurity