SchoolBus TR
(Backdoor.Win32.SchoolBus.b for Client)
(Backdoor.Win32.SchoolBus.c for Server)

by Gökhan Muharremoğlu

Written in Delphi

Released in June 1999

Made in Turkey

more versions 


Server:
dropped files:
c:\WINDOWS\SYSTEM\explorer.exe  size: 228.352 bytes 
c:\WINDOWS\SYSTEM\shell32.exe   size: 16.896 bytes 

port: 54321, 44767 TCP

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "ROOT" 
data: c:\windows\system\explorer.exe 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "ROOT2"
data: c:\windows\system\shell32.exe
MegaSecurity