Messiah 1.0
(Backdoor.Win32.VB.tj)

by Splinter

Written in Visual Basic

Released in July 2004

more versions




Server:
size: 120.103 bytes

dropped files (on win98):
c:\WINDOWS\SYSTEM\Cur.cur        size: 2.240 bytes 
c:\WINDOWS\SYSTEM\MSWINSOCK.ocx  size: 108.336 bytes 
c:\WINDOWS\SYSTEM\Update.exe     size: 120.103 bytes 

port: 876, 958, 1216 TCP

added to registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Windows Updates"
data: c:\windows\system\Update.exe
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Windows Updates"
data: c:\windows\system\Update.exe 

MegaSecurity