ProRat 2.0 Fix-2
(Backdoor.Win32.Prorat.19.p for Client)
(Backdoor.Win32.Prorat.19.i for Server)
(Trojan-Dropper.Win32.Delf.af)
(Trojan.Win32.Pakes.abp)
(Backdoor.Win32.Prorat.19.aep for reginv.dll)
(Backdoor.Win32.Prorat.19.ah for winkey.dll)

by P®O Group, modified by DarkHack

Released in May 2007

Made in Turkey

more versions 




Server:
dropped files:

c:\WINDOWS\services.exe             Size: 350,764 bytes 
c:\WINDOWS\system\sservice.exe      Size: 350,764 bytes 
c:\WINDOWS\system32\fservice.exe    Size: 350,764 bytes 
c:\WINDOWS\system32\reginv.dll      Size: 36,864 bytes 
c:\WINDOWS\system32\winkey.dll      Size: 13,312 bytes 


added to registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT Script Host\Microsoft DxDiag\WinSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore "DisableSR"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"
old data: Explorer.exe 
new data: Explorer.exe C:\WINDOWS\system32\fservice.exe 



tested on Windows XP
July 12, 2007
MegaSecurity