Optix Pro


Name: Optix Pro
Aliases: Backdoor.OptixPro, BackDoor.ACH,
Ports: 80, 1025, 1025 (UDP), 3410, 13371, 50021 (ports can be changed)
Files: Optixpro.zip - Optixpro1.0.zip - 1,217,435 bytes Optixpro1.2.zip - Client.exe - 381,952 bytes (compressed)Editor.exe - 367,616 bytes (compressed)My pic.jpg.exe - 941,604 bytes Spooll32.exe - Wmmiexe.exe - Dlldat.exe - 334,758 bytes Kernel32.exe - Winampw.exe - 45,568 bytes Win32loader.exe - - 331,264 bytes - 336,384 bytes (compressed) - 336,386 bytes (compressed) - 417,280 bytes - 889,344 bytes (uncompressed) - 889,346 bytes (uncompressed) - 907,776 bytes
Created: Apr 2002
Requires:
Actions: Anti-protection trojan / Remote Access / Keylogger / Steals passwords / FTP server
Registers: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\
HKEY_CLASSES_ROOT\exefile\shell\open\command
HKEY_LOCAL_MACHINE\Software\Classes\exefile\shell\open\command
Notes: Works on Windows 95, 98, ME, NT, 2000 and XP, together with IRC, ICQ and AOL software.
Country:
Program: Written in Borland Delphi 5.0.

© Copyright von Braun Consultants. This information may include technical inaccuracies or typographical errors. If you have any questions or further information about the actual trojan above, please contact Joakim von Braun at <joakim.von.braun@risab.se>