Psychward 1.0
(Backdoor.Win32.Psychward.10)

by evilgoat

Released in December 2000

more versions


notes about irc notify
----------------------

this version of psychward requires the user to login before the bot will respond to any commands.

commands:

!login <server password>    - log into bot, required for others commands
!op <nick>                  - if the bot has op status, will op the given nick
pwD <url>                   - downloads the url and executes the file
pwR                         - (only in private message) the bot will reconnect to the irc server
pwclose                     - (only in private message) closes the server
pwdie                       - (only in private message) removes the server
osver                       - makes the bot display the victims operating system
pwX                         - same as pwclose, but doesnt have the private message only restriction
pwinfo                      - make the bot spit out it's info, such as: version, ip address, port, owner string, password and the system uptime in hours

evilgoat


Server:
dropped file:
c:\WINDOWS\winvxd.exe
size: 23.072 bytes
 
port: 13013 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "WinVxd"
data: C:\WINDOWS\winvxd.exe 

tested on Windows 98
November 19, 2004

MegaSecurity