|
Description:
To get a one-glance comprehensive view of the behavior of this malware, refer to the Threat Diagram shown below.
Malware Overview
This backdoor may be dropped by the following malware:
It creates a temporary copy of itself as %UserTemp%\~~ then deletes it afterwards. It also creates the following empty files in %UserTemp% and attempts to execute it:
It also attempts to connect to the following IP address:
- {BLOCKED}.{BLOCKED}.165.42
It terminates processes that contain any of the following strings, if found running in memory:
It runs on Windows 98, ME, NT, 2000, XP, and Server 2003.
For additional information about this threat, see:
Solution
Technical Details
Description created: Sep. 29, 2009 7:58:28 AM GMT -0800
Search a new malware
Tell us how we did. Take our quick survey.
|
Save & Share
