SchoolBus 1.5
(Backdoor.Win32.SchoolBus.15)

by Serdar Kabaoglu

Written in Delphi

Released in June 1999

Made in Turkey

more versions


Server:
dropped file:
c:\WINDOWS\SYSTEM\Grcframe.exe 

size: 398 KB

port: 43210, 54321 TCP

startup:
c:\WINDOWS\SYSTEM\RUNONCE.EXE 

replaced:
c:\WINDOWS\SYSTEM\RUNONCE.EXE 

MegaSecurity