QueBus
(Backdoor.Win32.Sambus for NBSvr.exe)
(Backdoor.Win32.Sambus.dr for QueBus.exe)

By Quequero

Written in Assembly, source included

Released in November 1999

Made in Italy

more versions


Reversed NetBus


Server NBSvr.exe:
size: 597.504 bytes

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "SVGA Video Driver" 



Server QueBus.exe:
c:\WINDOWS\SYSTEM\bdrhUYec.exe 

size: 270.336 bytes 

port: 306 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "SVGA Video Driver" 

added:
c:\WINDOWS\SYSTEM\mfc40a.dll 
c:\WINDOWS\SYSTEM\s_s.vxd 

MegaSecurity