One 0.12 beta
(Backdoor.Onever.01)

by Szumi

Written in Delphi

Released in January 2002

Made in Poland


Client:
port: 402, 202, 212 TCP


Server:
c:\windows\winplay.exe

size: 294.912 bytes

port: 299, 401, 201, 211, 1001 TCP

startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

MegaSecurity