PcShare 2005 Build 0130
(Backdoor.Win32.PcClient.i)
(Backdoor.Win32.PcClient.j)

by shesh

Written in Microsoft Visual C++

Released in January 2005

Made in China

more versions


Server:
dropped files:
c:\WINNT\PcClient.dll           Size: 24,576 bytes 
c:\WINNT\server.exe             Size: 31,533 bytes 
c:\WINNT\system32\server.exe    Size: 31,533 bytes 

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run "PcShare"
data: C:\WINNT\server.exe 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "PcShare"
data: C:\WINNT\server.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run "PcShare"
data: C:\WINNT\system32\server.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "PcShare"
data: C:\WINNT\system32\server.exe 




tested on Windows 2000
June 01, 2005


MegaSecurity