SubRoot 1.2
(Backdoor.Win32.Subroot.12)

by cloak

Written in Delphi

Released in May 2003

more versions




Server:
c:\WINDOWS\SYSTEM\Navw32.exe 

size: 139.264 bytes 

port: 1201 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "Navw32 - 1201" 

MegaSecurity