Content

Backdoor-AJM

Type
Trojan
SubType
Remote Access
Discovery Date
08/02/2002
Length
233,984 bytes (Client)
196,608 bytes (Server)
Minimum DAT
4218 (08/14/2002)
Updated DAT
4218 (08/14/2002)
Minimum Engine
5.1.00
Description Added
08/15/2002
Description Modified
08/15/2002 4:47 PM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

This is a remote access Trojan, and consists of a client controller, and a server slave. The slave runs memory resident during Windows startup via a registry modification, and listens on TCP port 10, waiting for instructions from the client controller component.

If the server slave component is executed on a host system, it will copy itself to the Windows\system folder as "servidor.exe". It will modify the registry to load at Windows startup:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
    Run\WinSecurity = (%Windir%)\System\servidor.exe

Symptoms

  • Firewall alerts that communication is occuring on TCP port 10, or that "servidor.exe" is attempting to access the Internet.
  • Unexplained occurences such as the CD tray ejecting, hijacking of the mouse or keyboard, or even applications starting seemingly without user initiation.

    • Method of Infection

    If the server slave component is executed on a host system, it will copy itself to the Windows\system folder as "servidor.exe". It will modify the registry to load at Windows startup:

    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
      Run\WinSecurity = (%Windir%)\System\servidor.exe

    Removal

    All Users:
    Use current engine and DAT files for detection and removal.

    Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

    Additional Windows ME/XP removal considerations

    Variants

    Variants

      N/A

    All Information

    Overview -

    This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

    Aliases

    • Servidor

    Characteristics

    Characteristics -

    This is a remote access Trojan, and consists of a client controller, and a server slave. The slave runs memory resident during Windows startup via a registry modification, and listens on TCP port 10, waiting for instructions from the client controller component.

    If the server slave component is executed on a host system, it will copy itself to the Windows\system folder as "servidor.exe". It will modify the registry to load at Windows startup:

    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
      Run\WinSecurity = (%Windir%)\System\servidor.exe

    Symptoms

    Symptoms -

  • Firewall alerts that communication is occuring on TCP port 10, or that "servidor.exe" is attempting to access the Internet.
  • Unexplained occurences such as the CD tray ejecting, hijacking of the mouse or keyboard, or even applications starting seemingly without user initiation.

    • Method of Infection

    Method of Infection -

    If the server slave component is executed on a host system, it will copy itself to the Windows\system folder as "servidor.exe". It will modify the registry to load at Windows startup:

    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
      Run\WinSecurity = (%Windir%)\System\servidor.exe

    Removal -

    Removal -

    All Users:
    Use current engine and DAT files for detection and removal.

    Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

    Additional Windows ME/XP removal considerations

    Variants

    Variants -

      N/A