Helios 4.08-LE

Client:
port: 1171 TCP




Server:
dropped files:
c:\WINNT\winstart.bat             size: 150 bytes 
data:
@if exist C:\WINNT\system32\ScanStartup.exe goto it_exists
@copy C:\WINNT\system32\unist546.dat C:\WINNT\system32\ScanStartup.exe > NUL
:it_exists

c:\WINNT\system32\ScanStartup.exe size: 74.752 bytes 
c:\WINNT\system32\unist546.dat    size: 74.752 bytes 

port: 3322, 2701 TCP

startup:
c:\winnt\system.ini, [boot] "Shell"
value: Explorer.exe C:\WINNT\system32\ScanStartup.exe 

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows "run"
data: C:\WINNT\system32\ScanStartup.exe
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\ScanStartup "StubPath"
data: C:\WINNT\system32\ScanStartup.exe
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "ScanStartup"
data: C:\WINNT\system32\ScanStartup.exe
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices "ScanStartup"
data: C:\WINNT\system32\ScanStartup.exe 

tested on Win2000