English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Backdoor.Win32.Yoddos.cf

Detected Dec 21 2010 00:32 GMT
Released Dec 21 2010 05:19 GMT

This is a description which has been automatically generated following analysis of this program on a test machine. This description may contain incomplete or inaccurate information.

Summary


Technical details

File size of 35328 bytes.


Installation

Makes copies of itself with the following names once launched:

  • Windows system directory (usually, C:\Windows\System32) %System%\abgamet.exe

Ensures Using the system registry, system services or special system files, the program can launch itself or launch the creation of its files every time the Windows OS is subsequently booted autorun of the following installed files:

using system services:
Service name:MediaCabgamet
Displayed service name:MS Media Conabgamet Center
Startup parameters Windows system directory (usually, C:\Windows\System32) %System%\abgamet.exe
Startup type:­automatic­


Other activities

Modifies the system registry keys:

[ System registry hive HKEY_LOCAL_MACHINEHKLM\SYSTEM\ControlSet001\Services\MediaCabgamet ] "Description" = "Proeabgamet support for media palyer. This service can't be stoped."

Deletes the following files on an infected computer:

  • <­path to source program­><­file of source program ­>


Bookmark and Share
Share
Backdoor

Backdoors are designed to give malicious users remote control over an infected computer. In terms of functionality, Backdoors are similar to many administration systems designed and distributed by software developers.

These types of malicious programs make it possible to do anything the author wants on the infected computer: send and receive files, launch files or delete them, display messages, delete data, reboot the computer, etc.

The programs in this category are often used in order to unite a group of victim computers and form a botnet or zombie network. This gives malicious users centralized control over an army of infected computers which can then be used for criminal purposes.

There is also a group of Backdoors which are capable of spreading via networks and infecting other computers as Net-Worms do. The difference is that such Backdoors do not spread automatically (as Net-Worms do), but only upon a special “command” from the malicious user that controls them.


Aliases

Backdoor.Win32.Yoddos.cf (Kaspersky Lab) is also known as:

  • Trojan: BackDoor-DKA (McAfee)
  • Troj/Mdrop-CPV (Sophos)
  • Generic Trojan (Panda)
  • W32/Downloader.gen9 (FPROT)
  • Trojan:Win32/SystemHijack.gen!C (MS(OneCare))
  • BackDoor.Darkshell.246 (DrWeb)
  • Win32/Farfli.AY trojan (Nod32)
  • Gen:Trojan.Heur.JP.cu0@aewahFlG (BitDef7)
  • Backdoor.Yoddos!zHxfXJQxOiI (VirusBuster)
  • Win32:Agent-AERY [Trj] (AVAST)
  • Trojan.Win32.SystemHijack (Ikarus)
  • BackDoor.Generic13.QQX (AVG)
  • W32.Popwin (NAV)
  • NseCheckFile2() returned 0x00010018 (Norman)
  • Hack.DDoSer.Win32.Agent.rp (Rising)
  • Trojan:W32/SystemHijack.gen!A [FSE] (FSecure)
  • TROJ_DROPER.SMJZ (TrendMicro)
  • Backdoor.Yoddos!zHxfXJQxOiI (VirusBusterBeta)