Virus:Backdoor.Win32.DSSdoor.c
This Trojan program provides a remote malicious user with access to the victim machine. It is a Windows PE EXE file. The file is 419 969 bytes in size. It is packed using UPX. The unpacked file is approximately 890KB in size. This Trojan is written in Visual Basic. InstallationWhen launched, the backdoor installs Visual Basic components to the Windows system directory (%System%): MSINET.OCXregobj.dll SocketX.DLL SocketX.OCX It searches the system for the following processes: *firewall*.exe*zonealarm*.exe *zlclient*.exe frw.exe nc2000.exe jammer.exe cpd.exe comsocks.exe Smc.exe iamapp.exe persfw.exe pfwwadmin.exe Trojan Guarder.exe looknstop.exe Lnscfg.exe aports.exe PLManager.exe PLService.exe awpta.exe UpPDB.exe Commview.dll Anti-Virus&Trojan.exe LinkFerret.Exe ItCanNet.exe PRT.EXE NMain.exe netscanpro.exe Tcpview.exe tcpvcon.exe Anti-Virus&Spyware.exe Armor2net.exe fwsrv.exe sppfw.exe AlertWall.exe MPF.exe kpf4ss.exe kpf4gui.exe The backdoor will search for windows with the headings listed below: firewallZoneAlarm Net-Commando Jammer ComSocks SPF AtGuard Trojan Guarder Active Ports PortsLock AWPTA CommView LinkFerret Network Monitor ItCan.Net Monitor Net2112 TCPRT TSCAN PRO tcpview Anti-Virus&Trojan Anti-Virus&Spyware AlertWall SafeZone If the backdoor finds such window headings, it will cease installation. The backdoor then registers itself in the system registry: [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]"DSS" = "<path to Trojan executable file>" This ensures that the backdoor will be launched each time Windows is booted on the victim machine.
The Trojan opens a random port and listens for commands from the remote malicious user. The backdoor enables the remote malicious user to:
If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:
|
|||||||||