Troyano de MOD
(Backdoor.Win32.VB.ayy)

by txomin

Written in Visual Basic, source included

Released in November 2006


Client


Server




Server:
added to registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Emule"
data: \emule.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Local SAS"
data: C:\WINDOWS\lsass.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Messenger Service"
data: C:\Program Files\Messengermsmsgs.exe 

HKEY_CLASSES_ROOT\batfile\shell\open\command "(Default)"
old data: "%1" %* 
new data: KernelVX.com "%1" %* 

HKEY_CLASSES_ROOT\cmdfile\shell\open\command "(Default)"
old data: "%1" %* 
new data: KernelVX.com "%1" %* 

HKEY_CLASSES_ROOT\comfile\shell\open\command "(Default)"
old data: "%1" %* 
new data: KernelVX.com "%1" %* 

HKEY_CLASSES_ROOT\exefile\shell\open\command "(Default)"
old data: "%1" %* 
new data: KernelVX.com "%1" %* 

HKEY_CLASSES_ROOT\piffile\shell\open\command "(Default)"
old data: "%1" %* 
new data: KernelVX.com "%1" %* 

HKEY_CLASSES_ROOT\scrfile\shell\open\command "(Default)"
old data: "%1" /S 
new data: KernelVX.com "%1" %* 




tested on Windows XP
November 04, 2006

MegaSecurity