PcShare 2005 Build 0514
(Not detected by KAV on May 31, 2005)
(Backdoor.Win32.PcClient.al for PcInit.exe)

by shesh

Written in Microsoft Visual C++

Released in May 2005

Made in China

more versions 


Server:
dropped files:
c:\WINNT\system32\00019942.dll   Size: 31,288 bytes 
c:\WINNT\system32\server.exe     Size: 29,644 bytes 

startup:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Messenger "ImagePath"
old data: %SystemRoot%\System32\services.exe 
new data: C:\WINNT\system32\server.exe 




tested on Windows 2000
May 31, 2005
MegaSecurity