BKDR_REMOSH.BD

This backdoor may be dropped by other malware. It may be manually installed by a user.

It uses common file icons to trick a user into thinking that the files are legitimate.

It deletes itself after execution.

Arrival Details

This backdoor may be dropped by the following malware:

• SWF_DROPPER.BD

It may be manually installed by a user.

Installation

This backdoor drops the following component file(s):

• %System%\recycler32.dll

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Its DLL component is injected to the following process(es):

• svchost.exe

It uses common file icons to trick a user into thinking that the files are legitimate.

Autostart Technique

This backdoor adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\6to4
ImagePath = %systemroot%\system32\svchost.exe -k netsvcs

Other System Modifications

This backdoor adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\6to4\Parameters
ServiceDll = %System%\recycler32.dll

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\6to4\Security
Security = {random value}

Other Details

This backdoor deletes itself after execution.