Internet threat level: 1
Home→Descriptions→Backdoor.Win32.Delf.duc
Backdoor.Win32.Delf.duc
| Detected | Mar 04 2008 10:27 GMT |
| Released | Mar 04 2008 13:38 GMT |
| Published | Sep 04 2008 13:21 GMT |
Payload
Removal instructions
Technical Details
This malicious program is a Trojan. It is a Windows PE EXE file. It is 447488 bytes in size.
Payload
The backdoor downloads a list of links to files on the Internet from the following URL:
is the MAC address of the network adapter.
The backdoor then randomly selects a link from the list, downloads the file placed on the link, and saves it to one of the following folders:
C:\Windows\addins\ C:\Windows\AppPatch\ C:\Windows\Config\ C:\Program Files\Internet Explorer\SIGNUP\ C:\Program Files\Common Files\System\ C:\Program Files\Internet Explorer\Connection Wizard\ C:\Program Files\Internet Explorer\Custom\ C:\Program Files\Internet Explorer\MUI\ C:\Program Files\Internet Explorer\PLUGINS\ c:\windows\ c:\temp c:\windows\system32\ c:\Program Files\ c:\Program Files\Common Files\ C:\Program Files\Common Files\Microsoft Shared\ C:\Program Files\Common Files\Microsoft Shared\Windows Live\ C:\Program Files\Common Files\Microsoft Shared\MSInfo\ C:\Program Files\Common Files\Services\
The file is saved as "mypark.exe" and is then launched for execution.
Removal instructions
If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:
- Use Task Manager to terminate the malicious program’s process.
- Delete the original backdoor file (the location will depend on how the program originally penetrated the victim machine).
- Delete "mypark.exe" from the following folders:
C:\Windows\addins\ C:\Windows\AppPatch\ C:\Windows\Config\ C:\Program Files\Internet Explorer\SIGNUP\ C:\Program Files\Common Files\System\ C:\Program Files\Internet Explorer\Connection Wizard\ C:\Program Files\Internet Explorer\Custom\ C:\Program Files\Internet Explorer\MUI\ C:\Program Files\Internet Explorer\PLUGINS\ c:\windows\ c:\temp c:\windows\system32\ c:\Program Files\ c:\Program Files\Common Files\ C:\Program Files\Common Files\Microsoft Shared\ C:\Program Files\Common Files\Microsoft Shared\Windows Live\ C:\Program Files\Common Files\Microsoft Shared\MSInfo\ C:\Program Files\Common Files\Services\
- Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).
Backdoors are designed to give malicious users remote control over an infected computer. In terms of functionality, Backdoors are similar to many administration systems designed and distributed by software developers.
These types of malicious programs make it possible to do anything the author wants on the infected computer: send and receive files, launch files or delete them, display messages, delete data, reboot the computer, etc.
The programs in this category are often used in order to unite a group of victim computers and form a botnet or zombie network. This gives malicious users centralized control over an army of infected computers which can then be used for criminal purposes.
There is also a group of Backdoors which are capable of spreading via networks and infecting other computers as Net-Worms do. The difference is that such Backdoors do not spread automatically (as Net-Worms do), but only upon a special “command” from the malicious user that controls them.
Backdoor.
- Trojan:
Generic BackDoor (McAfee) - Mal/Generic-A (Sophos)
- W32/Backdoor2.
DLQU (FPROT) - Trojan.
DownLoader. 44888 (DrWeb) - a variant of Win32/Delf trojan (Nod32)
- Backdoor.
Generic. 93515 (BitDef7) - Win32:
Trojan-gen {Other} (AVAST) - Trojan-Dropper.
Delf (Ikarus) - BackDoor.
Generic10. VIQ (AVG) - BDS/Delf.
duc. 1 (AVIRA) - Downloader (NAV)
- W32/Delf.
CTFL (Norman) - Trojan.
DL. Win32. Delf. cnk (Rising)
© 1997-2012 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.