Rewind 1.4
(Backdoor.Rewindor.14)

by Loki & B33T

Written in Visual Basic

Released in february 2004

more versions


Server:
c:\WINDOWS\Msgrt32.exe 

size: 222.390 bytes 

port: 1263, 1266, 1456, 6000, 6001 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "WinCSRSS" 

dropped files:
c:\WINDOWS\DIjpg.dll 
c:\WINDOWS\mes.rew 
c:\WINDOWS\Msgrt32.exe 
c:\WINDOWS\Winsys32.exe 

MegaSecurity