Levelone (c)
(Backdoor.Win32.Levelone.c)

by ?

aka Level l IRCBOT

Written in C

Made in Italy

more versions 


dropped file:
c:\WINDOWS\system32\MsgUpdate.exe
size: 11.047 bytes 

port: 9000 TCP

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices "MsgLL"
data: C:\WINDOWS\System32\MsgUpdate.exe AvRun 


attempts to connect to an IRC server


tested on Windows XP
December 27, 2004
MegaSecurity