Helios 2.0
(Backdoor.Win32.Helios.20 for client)
(Backdoor.Win32.VB.bj for server)

by Helios

Written in Visual Basic

Released in August, 2002

Made in Belgium

more versions 


Server:
dropped file:
c:\WINDOWS\system32\ScanStartup.exe
size: 143,360 bytes 

port: 3737 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\SCANSTARTUP "StubPath"
 data: C:\WINDOWS\SYSTEM32\SCANSTARTUP.EXE 
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "SCANSTARTUP"
data: C:\WINDOWS\SYSTEM32\SCANSTARTUP.EXE 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices "SCANSTARTUP"
data: C:\WINDOWS\SYSTEM32\SCANSTARTUP.EXE 



tested on Windows XP
February 20, 2005
MegaSecurity