|
|
NetSphere is a "complete" trojan that contains most the usual features, plus a friendly console GUI. Ports - TCP 30100
- The main port that NetSphere connects to.
- TCP 30101
- An FTP service that is used to transfer various files, such as the keylog files.
- TCP 30102
- Another FTP services runs at this port.
 Info - Infects only Win9x
- The server program is called nssx.exe and is placed in the c:\windows\system directory.
- A value named "NSSX" is added to the Run registry that launches the server.
- The authors are Sean "DeathBreadstick" Hamilton, and Adam "Beefcake" McGirr.
Removal Simply remove the NSSX entry from Run and remove the program c:\windows\system\nssx.exe
|
