NokNok 5.0
(Backdoor.Win32.Noknok)

by V.P

Written in Delphi

Released in December 1996

Made in Lithuania

more versions


Server:
dropped file:
c:\Program Files\WinSecurity\securpatch.exe
size: 501.760 bytes
 
port: 5400, 5401, 5402 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "SystemTray"
old data: SysTray.Exe 
new data: C:\PROGRAM FILES\WINSECURITY\SECURPATCH.EXE 

tested on Windows 98
08 November 2004

MegaSecurity