NetBull 1.1 (a)
(Backdoor.Win32.NetBull.11.a)

by ?

Written in Visual C++

Released in April 2001

Made In China

more versions


Server:
c:\WINDOWS\SYSTEM\CheckDll.exe 

size: 102.400 bytes 

port: 23444 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "CheckDll.exe" 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "CheckDll.exe" 

added:
c:\infected.exe 

MegaSecurity