The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1


Detected Aug 03 2002 20:00 GMT
Released Aug 03 2002 20:00 GMT
Published Nov 23 2007 10:16 GMT

Technical Details
Removal instructions

Technical Details

This Trojan program is designed to provide remote management of systems running UNIX-type operating systems. It is a Perl scenario. It is approximately 12KB in size.


This Trojan has two parts, a server and a client. The execution depends on the parameters with which the Trojan is launched.

The server part opens a port which is specified in the body of the Trojan. The Trojan waits for a connection to this port and attempts to use the command line interpreter to run all commands received from the remote client.

The client is a shell for sending commands to the server part and for getting service messages.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

  1. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
  2. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).

Bookmark and Share

Backdoors are designed to give malicious users remote control over an infected computer. In terms of functionality, Backdoors are similar to many administration systems designed and distributed by software developers.

These types of malicious programs make it possible to do anything the author wants on the infected computer: send and receive files, launch files or delete them, display messages, delete data, reboot the computer, etc.

The programs in this category are often used in order to unite a group of victim computers and form a botnet or zombie network. This gives malicious users centralized control over an army of infected computers which can then be used for criminal purposes.

There is also a group of Backdoors which are capable of spreading via networks and infecting other computers as Net-Worms do. The difference is that such Backdoors do not spread automatically (as Net-Worms do), but only upon a special “command” from the malicious user that controls them.

Other versions


Backdoor.Perl.AEI.16 (Kaspersky Lab) is also known as:

  • Troj/AEI-A (Sophos)
  • Trojan.Perl.AEI (ClamAV)
  • Backdoor Program (Panda)
  • Backdoor:Perl/AEI.16 (MS(OneCare))
  • Perl.BackDoor.Hauser (DrWeb)
  • Perl/AEI.16 (Nod32)
  • Perl.Backdoor.RevTunnel.A (BitDef7)
  • Backdoor.Perl.AEI.A (VirusBuster)
  • VBS:Malware [Gen] (AVAST)
  • Backdoor.Perl.AEI.16 (Ikarus)
  • Backdoor.Unix.THC (NAV)
  • BackDoor-AEI.php (NAI)
  • Backdoor.Agent.fnt (Rising)