McAfee > Theat Center > Virus Detail Page

Overview

This is a description for a backdoor trojan that attempts to dial through a modem to create an internet connection. It has capabilities to capture keystrokes and send e-mails.

Characteristics

1. Creates the following "Run" registry key for auto restart on reboot.
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft VM: [path to executable]
  
2. Searches for *.pbk files that are commonly in
• %ALLUSER%\Application Data\Microsoft\Network\Connections\Pbk\ 
• %Sysdir%\Ras
  If the file is found the trojan will constantly try to dial the numbers in the phone book to create an internet connection through modem.
  
3. Tries to enumerate and collect information about the following system properties.
• LOGONSERVER
• HOMEDRIVE
• HOMEPATH 
• CLIENTNAME 
• SESSIONNAME 
• APPDATA 
• HOMESHARE 
  
4. Constantly tries to download files from www.(removed)wo.net
   
5. May connect to a proxy server based in Germany
   
6. The backdoor has capability of sending mails, it uses an open source sendmail program from the following website for this purpose.
• www.(removed)quit.com
  
7. It also has capability of taking screenshots, capture keystrokes, upload and download binary data.
   
8. Masquerades as a Microsoft file and has following string in its description "Windows NT-Befehlsprozessor"
   
9. Listens on random TCP ports.

Symptoms

Presence of aforementioned registry key and excessive network activity due to DNS queries.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc.

Removal

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a description for a backdoor trojan that attempts to dial through a modem to create an internet connection. It has capabilities to capture keystrokes and send e-mails.

Characteristics

Characteristics -

1. Creates the following "Run" registry key for auto restart on reboot.
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft VM: [path to executable]
  
2. Searches for *.pbk files that are commonly in
• %ALLUSER%\Application Data\Microsoft\Network\Connections\Pbk\ 
• %Sysdir%\Ras
  If the file is found the trojan will constantly try to dial the numbers in the phone book to create an internet connection through modem.
  
3. Tries to enumerate and collect information about the following system properties.
• LOGONSERVER
• HOMEDRIVE
• HOMEPATH 
• CLIENTNAME 
• SESSIONNAME 
• APPDATA 
• HOMESHARE 
  
4. Constantly tries to download files from www.(removed)wo.net
   
5. May connect to a proxy server based in Germany
   
6. The backdoor has capability of sending mails, it uses an open source sendmail program from the following website for this purpose.
• www.(removed)quit.com
  
7. It also has capability of taking screenshots, capture keystrokes, upload and download binary data.
   
8. Masquerades as a Microsoft file and has following string in its description "Windows NT-Befehlsprozessor"
   
9. Listens on random TCP ports.

Symptoms

Symptoms -

Presence of aforementioned registry key and excessive network activity due to DNS queries.

Method of Infection

Method of Infection -

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, etc.

Removal -

Removal -

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A