Philix
(Backdoor.Win32.IRC.Philix)

by philix

Compressed with NeoLite




size: 31.874 bytes

port: 113 TCP

added to registry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "Windows shell emulator"
data: winshe.exe 

attempts to connect to an IRC server

tested on Windows XP
November 30, 2004

MegaSecurity