PcShare 2005 Build 0328
(Backdoor.Win32.PcClient.q)

by shesh

Written in Microsoft Visual C++

Released in March 2005

Made in China

more versions


Server:
dropped files:
c:\WINNT\system32\Server.asf    Size: 28,672 bytes 
c:\WINNT\system32\Server.exe    Size: 17,923 bytes 
c:\WINNT\system32\Server.wmv    Size: 77,824 bytes 

startup:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule "ImagePath"
old data: %SystemRoot%\system32\MSTask.exe 
new data: C:\WINNT\system32\Server.exe 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule "ImagePath"
old data: %SystemRoot%\system32\MSTask.exe 
new data: C:\WINNT\system32\Server.exe 



tested on Windows 2000
May 25, 2005


MegaSecurity