| Name: | Connection |
| Aliases: | |
| Ports: | 60411 (port can not be changed) |
| Files: | Connection.zip - 140,156 bytes Connection1.0.zip - Connection1.1.zip - 152,028 bytes Connection1.2.zip - 20,171 bytes Connection1.3.zip - 19,932 bytes Connection.exe - 10,752 bytes Connection.exe - 23,040 bytes Connection.exe - 26,112 bytes Winoldap.exe - 14,848 bytes Winoldap.exe - 26,112 bytes Winoldap.exe - 27,136 bytes Server.exe - 14,848 bytes Winrun.exe - Setup.exe - 26,624 bytes Normalserver.exe - 139,656 bytes Virusserver.exe - 141,672 bytes |
| Created: | May 2000 |
| Requires: | Mswinsck.ocx and Msvbvm50.dll - are required to run the trojan. |
| Actions: | Remote Access / Virus dropper / Virus / Steals passwords |
| Virusserver.exe actually binds to other .exe files by infectingthem. The virusdropping server drops what´s is called the | |
| Versions: | 1.0, 1.1, 1.2, 1.3, |
| Registers: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ HKEY_CURRENT _USER\Software\Microsoft\Windows\CurrentVersion\RunServices\ HKEY_LOCAL_MACHINE\ SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ HKEY_LOCAL_MACHINE\SOFTWARE\Micro soft\Windows\CurrentVersion\RunServices\ |
| Notes: | Works on Windows 95, 98, ME, NT and 2000. |
| Country: | written in Brazil |
| Program: |