SchoolBus 2.0
(Backdoor.Win32.SchoolBus.b)

by Serdar Kabaoglu

Written in Delphi

Released in October 1999

Made in Turkey

more versions


Server:
c:\WINDOWS\SYSTEM\Grcframe.exe 

size: 328.110 bytes

port: 43210, 54321 TCP

startup:
c:\WINDOWS\SYSTEM\RUNONCE.EXE 

added:
c:\WINDOWS\SYSTEM\ro.dll 

replaced:
c:\WINDOWS\SYSTEM\RUNONCE.EXE 

MegaSecurity