Content
Downloader-DM
- Type
- Trojan
- SubType
- Dropper
- Discovery Date
- 08/02/2003
- Length
- 113,507 bytes
- Minimum DAT
- 4283 (08/06/2003)
- Updated DAT
- 4374 (07/07/2004)
- Minimum Engine
- 5.1.00
- Description Added
- 08/02/2003
- Description Modified
- 08/06/2003 2:03 PM (PT)
Risk Assessment
- Corporate User
- Low-Profiled
- Home User
- Low-Profiled
Tab Navigation
Characteristics
-- Update August 04, 2003 --
The risk assessment of this threat was updated to Low-Profiled due to the c|net article Attack bot exploits Windows flaw.
This is not an email virus. This downloader trojan has been found within a self-extracting dropper package (possibly named worm.exe 113,507 bytes). The self-extracting archive carries 3 files.
The following files are contained within the dropper.
| rpc.exe | 40,960 bytes | downloader trojan, tries to exploit MS03-026 to instruct a remote host to download lolx.exe from the infected host, via tftp, and run the downloaded exe |
| rpctest.exe | 94,298 bytes | MS03-026 exploit tool, creates remote shell on TCP port 57005 |
| tftpd.exe | 143,872 bytes | haneWIN TFTP server |
Symptoms
Presence of the following files on the root directory:
- rpc.exe
- rpctest.exe
- tftpd.exe
Method of Infection
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc. Trojans may also be received as a result of poor security practices (weak username/password combination on open shares, lack of/or misconfigured firewall protection), or unpatched and vulnerable systems.
Removal
All Users:
Use specified engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Variants
Variants
N/A
All Information
Overview -
This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.
Aliases
- Autorooter (Panda)
- Backdoor.IRC.Cirebot (Symantec)
- Mescaline
- RPC Worm (F-Secure)
- Worm.Win32.Autorooter (AVP)
Characteristics
Characteristics -
-- Update August 04, 2003 --
The risk assessment of this threat was updated to Low-Profiled due to the c|net article Attack bot exploits Windows flaw.
This is not an email virus. This downloader trojan has been found within a self-extracting dropper package (possibly named worm.exe 113,507 bytes). The self-extracting archive carries 3 files.
The following files are contained within the dropper.
| rpc.exe | 40,960 bytes | downloader trojan, tries to exploit MS03-026 to instruct a remote host to download lolx.exe from the infected host, via tftp, and run the downloaded exe |
| rpctest.exe | 94,298 bytes | MS03-026 exploit tool, creates remote shell on TCP port 57005 |
| tftpd.exe | 143,872 bytes | haneWIN TFTP server |
Symptoms
Symptoms -
Presence of the following files on the root directory:
- rpc.exe
- rpctest.exe
- tftpd.exe
Method of Infection
Method of Infection -
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc. Trojans may also be received as a result of poor security practices (weak username/password combination on open shares, lack of/or misconfigured firewall protection), or unpatched and vulnerable systems.
Removal -
Removal -
All Users:
Use specified engine and DAT files for detection and removal.
Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A
