WAY 2.5 [skyfire]
(Backdoor.Win32.Way.25)

modified by Skyfire



Released in August 2001

Made in China

more versions



Server:
c:\WINDOWS\SYSTEM\msgsvc.exe 

size: 647.212 bytes

port: 9000, 52365 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "Msgtask" 

MegaSecurity