|Detected||Jan 10 2009 21:35 GMT|
|Released||Jan 11 2009 02:10 GMT|
|Published||Apr 15 2009 07:57 GMT|
This Trojan provides a remote malicious user with access to the victim machine. It is a Windows PE EXE file. It is 22528 bytes in size.
Once launched, the Trojan copies its body to the Windows system directory as "digeste.dll":
In order to ensure that the Trojan is launched automatically each time the system is restarted, the Trojan registers its executable file in the system registry:
In order to flag its presence in the system, the Trojan creates a unique identifier: "_SYSTEM_F2A5DE7_”.
The Trojan launches a copy of the svchost.exe process and injects part of its malicious code (detected by Kaspersky Anti-Virus as Backdoor.Win32.Small.gra) into this process. This code sends an http request containing the information show below to the remote malicious user’s server:
"uid” is "1"; "guid” is the serial number of the disk; “rnd” is a random number; “first” indicates the first launch of the malicious program (if this is the first launch, this value will be "1", otherwise it will be "0").
The backdoor then receives commands on what action to take. The Trojan saves its log files to the Windows directory as shown below:
At the time of writing, the remote malicious server was not accessible.
If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:
Backdoors are designed to give malicious users remote control over an infected computer. In terms of functionality, Backdoors are similar to many administration systems designed and distributed by software developers.
These types of malicious programs make it possible to do anything the author wants on the infected computer: send and receive files, launch files or delete them, display messages, delete data, reboot the computer, etc.
The programs in this category are often used in order to unite a group of victim computers and form a botnet or zombie network. This gives malicious users centralized control over an army of infected computers which can then be used for criminal purposes.
There is also a group of Backdoors which are capable of spreading via networks and infecting other computers as Net-Worms do. The difference is that such Backdoors do not spread automatically (as Net-Worms do), but only upon a special “command” from the malicious user that controls them.