# MA-007.031999: MyCERT Advisory - NetBus

**Date:** 01 Mar 1999  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-007.031999  
**Advisory ID:** MA-007.031999

---

1.0 Description
#### 1.1 Overview
This program is called a NetBus which is a close cousin of [Back Orifice(BO)](/en/services/advisories/mycert/1999/main/detail/149/index.html). It has similar function to BO, and in some ways more advanced than BO. NetBus has been available, but its widespread use as a hacking tool has not occurred until recently. Unlike BO, NetBus will run on Windows NT besides Window 95/98.
MyCERT observed that these virus/trojan are spread via email attachments of infected files of various forms, i.e audio and image file application and games software. In order to protect your PC, please be careful when downloading using Netscape, Internet Expolre, FTP, etc., or reading / executing e-mail attachments, especially executable files, usually of the form **filename.exe**. Scan all the attachment before executing it even from trusted senders.
### 2.0 Technical Matters
#### 2.1 Installation
NetBus uses TCP for communication, and always uses ports 12345 and 12346 for listening for connections. NetBus could be installed deliberately, or by tricked(e.g. through attachment files in e-mail or doubious downloadable file). However, the file has to be executed in order for it to be installed. By default, the NetBus server is called **Patch.exe** or **SysEdit.exe**, but it can be renamed.
Once installed, it creates a registry key under
HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
#### 2.2 Functionality
NetBus allows intruders to manipulate system control(e.g. log keystrokes, lockup or reboot), file system control(e.g. copy, rename, delete, view, and search files), process control(e.g. list, kill, and spawn processes), registry control(e.g. list, create, delete and set keys and values), network control(e.g. list, create and delete network connections) as well as other functions.
### 3.0 Possible Steps
#### 3.1 Detection
3.1.1 In dos prompt, type 'telnet localhost 12345'. If NetBus is installed, a string similar to 'NetBus 1.53' or 'NetBus 1.60 x' will be displayed when you connect.
3.1.2. First you must have to be connected to internet. Then, you can use the netstat program to check if the system is vulnerable. 'netstat -an' will list all connected and listening ports, so you can see if there are any open TCP ports that shouldn't be open, and take corrective action.
Here is some sample output from netstat:
C:\WINDOWS>netstat -an | find "TCP"
TCP 0.0.0.0:12345 \*:\*
TCP 0.0.0.0:12346 \*:\*
In this example, you can see a TCP service listening on port 12345 and 12346. This service is NetBus.
#### 3.2 Reaction/Removal
You could remove NetBus manually.
3.2.1. Here are the steps
3.2.1.1. Go to ' Start ' then click on 'Run'. Type regedit and click ok.
3.2.1.2. Now click on the
HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
3.2.1.3. Find the NetBus register (in this case patch.exe), just click on the filename in the settings and right click then choose Delete.
3.2.1.4. Close the editor then restart your computer in DOS mode.Once in DOS mode ( not in Window dos-prompt ), go to windows directory and look for the NetBus copy there (same filename). Once found delete it.
3.2.1.5. Next in Dos mode, do a dir/w \*.dll and you will be listed all the .dll files. Look for KEYHOOK.DLL and delete it.
3.2.1.6. Restart your Windows and you should be NetBus free. To check run the steps on netstat again (refer to 3.1 Detection).
3.2.2. Another approach, could be to use the NetBus-client (NetBus.exe) yourself, connect to localhost, choose "Server admin" and click on the "Remove server" button.
3.2.3. Furthermore, as of today, the list below are the sites that provide a solution in detecting and removing this backdoor. However, users are strongly advised to visit their respective anti-virus vendor sites from time to time for their updates.
Protector Plus antivirus
**http://www.pspl.com/download/download.htm**
F-Secure Anti-Virus
**http://www.datafellows.com**
Here are list of current vendors is available in MyCERT's Links to Updated Anti-Virus Database.
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc
)
### 4.0 More Information
To obtain more information on this virus, please refer to the following site :
4.1 **http://www.nwi.net/~pchelp/nb/netbus.htm**
4.2 **http://www.europe.f-secure.com/v-descs/netbus.shtml**
4.3 **http://www.pspl.com/trojan\_info/win32/netbus.htm**