PcShare 050810 GoldKiss
(Backdoor.Win32.PcClient.ec)
(Trojan.Win32.Crypt.k)
(Backdoor.Win32.PcClient.cj)
(Backdoor.Win32.PcClient.ch)
(Backdoor.Win32.PcClient.gf)
(Backdoor.Win32.PcClient.ca)
(Backdoor.Win32.PcClient.cm)
(Backdoor.Win32.PcClient.bh)
(Backdoor.Win32.PcClient.bg)
(Backdoor.Win32.PcClient.bl)

by shesh

Written in Microsoft Visual C++

Released in August 2005

Made in China

more versions


Server:
added to registry:
HKEY_USERS\.DEFAULT\Software\Microsoft\Multimedia\DrawDib
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\SYSTEM\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\SYSTEM\0001
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{FCC0546B-075A-4729-96D6-CD283E50D55B}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\MediaCategories\{FB6C4286-0353-11d1-905F-0000C0CC16BA}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Session Manager\AppCompatibility\_SETUP.EXE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\{FCC0546B-075A-4729-96D6-CD283E50D55B}\Parameters\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\System\WZCSVC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatibility\_SETUP.EXE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_YYFMLREA\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{FCC0546B-075A-4729-96D6-CD283E50D55B}\Parameters\Tcpip


tested on Windows 2000
November 03, 2005


MegaSecurity