SchoolBus TR 2.0 modified
(Backdoor.Win32.SchoolBus.b)

by Gökhan Muharremoğlu

Written in Delphi

Released in October 1999

Made in Turkey

more versions


Server:
dropped files:
c:\WINDOWS\SYSTEM\grcframe.exe  size: 575.488 bytes 
c:\WINDOWS\SYSTEM\ro.dll        size: 36.864 bytes 
c:\WINDOWS\SYSTEM\RUNONCE.EXE   size: 16.896 bytes (replaced)

port: 54321, 44767 TCP

startup:
none

MegaSecurity