WAY 2.0
(Backdoor.Win32.Way.20)

by Phoenix

Compressed with ASPack

Released in March 2001

Made in China

more versions


Client:
port:
6711, 2222 TCP



Server:
C:\WINDOWS\SYSTEM\MSGSVC.EXE
C:\WINDOWS\SYSTEM\NOTEPAD.EXE

size: 202.752 bytes

port: 8011 TCP

startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCR\txtfile\shell\open\command

MegaSecurity