Carufax (b)
(Backdoor.Win32.Carufax.b)

by ?

Compressed with PECompact

more versions


dropped files:
c:\Documents and Settings\%user%\Application Data\Microsoft\internt.exe      Size: 16,384 bytes 
c:\Documents and Settings\%user%\Application Data\Microsoft\kbdext.dll    Size: 94,208 bytes 

port: 11311 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "internt"
data: C:\Documents and Settings\Kobayashi\Application Data\Microsoft\internt.exe 

attempts to connect to an IRC Server



tested on Windows XP
March 16, 2006

MegaSecurity