Carufax (a)
(Backdoor.Win32.Carufax.a)

by ?

Compressed with PECompact

Made in Korea (?)

more versions


dropped files:
c:\Documents and Settings\%user%\Application Data\Microsoft\internt.exe
size: 17,408 bytes 

c:\Documents and Settings\%usr%\Application Data\Microsoft\kbdext32.dll
size: 94,208 bytes 

port: 11311 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "internt"
data: C:\Documents and Settings\%user%\Application Data\Microsoft\internt.exe 


attempts to connect to an IRC Server



tested on Windows XP
April 02, 2005

MegaSecurity