Witch Control 2004
(Backdoor.Win32.Vb.pu)
(Backdoor.Win32.DSNX.04 for server_builder)

by TyperCrack

Written in Visual Basic

Released in April 2004




Dropped file by server_builder.exe:

c:\WINDOWS\SYSTEM\winaxsb.exe 

size: 41.472 byte

startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "WinDSNX"

The dropped server does connect to IRC.
Client seems not to be working.

MegaSecurity