TeknoJan 1.0
(Backdoor.Win32.VB.bak)

by

Written in Visual Basic

Released in June 2006

Made in Turkey


Server:
size: 315,392 bytes

added to registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Winsk32"
data: C:\WINDOWS\System32\winsk\Winsk32.exe 

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List "C:\WINDOWS\System32\Winsk\Winsk32.exe"
data: C:\WINDOWS\System32\Winsk\Winsk32.exe:*:Enabled 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List "C:\WINDOWS\System32\Winsk\Winsk32.exe"
data: C:\WINDOWS\System32\Winsk\Winsk32.exe:*:Enabled 

port: 15000 TCP



tested on Windows XP
March 06, 2007

MegaSecurity