R0xR4t 1.0 Beta 1
(Backdoor.Win32.Roxrat.10.a)
(Backdoor.Win32.Roxrat.10.b)

by c400s

Written in Delphi

Released on June 02, 2002

Made in Brazil

more versions





Server:
C:\WINDOWS\RUNDLL666.EXE 
C:\WINDOWS\SYSTEM\RUNVXD32.EXE 

size: 559.616 bytes

port: 5050, 60552 TCP

startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "Run DLL 666" 
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices "Run DLL 666" 
HKCR\txtfile\shell\open\command "(Default)" 
c:\windows\system.ini, [boot] "shell" 
c:\windows\win.ini, [windows] "run" 

MegaSecurity