Optix Lite 0.4 (b) server
(Backdoor.Win32.Optix.04.b)

by xMs and th3 s13az3

Written in Delphi

more versions




dropped files:
c:\WINDOWS\winstart.bat           size: 174 bytes      
c:\WINDOWS\JAVA\apps\wsock32.exe  size: 32.256 bytes 
c:\WINDOWS\SYSTEM\ssound32.drv    size: 32.256 byte

port: 1063 TCP

added to registry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders "Common Startup"
data: C:\WINDOWS\java\apps 

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Hardware Profiles\Current\Software\Microsoft\windows\CurrentVersion\Internet Settings "EnableAutodial"


tested on Windows 98
December 14, 2004

MegaSecurity