R0xR4t 1.0 Beta 2
(Backdoor.Win32.Roxrat.10.c)
(Backdoor.Win32.Roxrat.10.a for editserver)

by c400s

Written in Delphi

Released on July 06, 2002

Made in Brazil

more versions





Server:
C:\WINDOWS\RUNDLL666.EXE 
C:\WINDOWS\SYSTEM\RUNVXD32.EXE 

size: 550 KB

port: 5050, 60552 TCP

startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run "Run DLL 666" 
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices "Run DLL 666" 
HKCR\txtfile\shell\open\command "(Default)" 
c:\windows\system.ini, [boot] "shell" 
c:\windows\win.ini, [windows] "run" 

MegaSecurity