Malware type: Backdoor

Aliases: No Alias Found

In the wild: Yes

Destructive: No

Language: English

Platform: Windows 98, ME, NT, 2000, XP, Server 2003

Encrypted: No

Overall risk rating:

Reported infections:

Damage potential:


Distribution potential:



Trend Micro has received multiple samples of this malware from a malicious domain source, http://bebebi.in, that have infected many clients. These indicate that this malware poses a high risk to users due to the increased possibility of infection.

To get a one-glance comprehensive view of the behavior of this malware, refer to the Threat Diagram shown below.

BKDR_TIDSERV.DZBehavior Diagram

Malware Overview

This backdoor may be downloaded from certain remote sites.

It drops component files.

It connects to certain websites to send and receive information. However, as of this writing, the said sites are inaccessible.

It intercepts the user's browsing habit data and posts them on the said websites. It also obtains system information such as OS version and system locale.

It hooks to certain APIs to hide the malware's window.

For additional information about this threat, see:

Description created: Jul. 6, 2010 4:01:27 AM GMT -0800


File type: EXE

Memory resident:  Yes

Size of malware: 93,696 Bytes

Initial samples received on: Apr 2, 2010

Payload 1: Drops files

Payload 2: Hides files and processes


Arrival Details

This backdoor may be downloaded from the following remote site(s):

  • http://{BLOCKED}.in


This backdoor is loaded by PE_TDSS.A. It is assembled during system startup process and its content is saved directly to the harddisk without any file representation.

Other System Modifications

It modifies or creates the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\
"Default" = "8888" (Web pages are displayed in Internet Explorer 8, regardless of the !DOCTYPE directive.)

CurrentVersion\Internet Settings
maxhttpredirects = "8888"
enablehttp1_1 = "1"

CurrentVersion\Internet Settings\zones\3
currentlevel = "0"
1601 = "0"
1400 = "0"

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\
acceptlanguage = "en-us"

Backdoor Capabilities

It obtains the server URL from its CONFIG.INI file. If there's none, it sets the URL to http://{BLOCKED}a1i0.com then initializes the Internet connection.

It also obtains the APIs it needs for ActiveX control:

  • AtlAdvise
  • AtlUnadvise
  • AtlAxCreateControlEx

It creates a window with the name svchost that gets, translates, and dispatches messages. If this action is successful, it sleeps for 60000ms, deletes the URL cache and downloads the malware file.

This backdoor connects to the following Web sites to send and receive information:

  • http://{BLOCKED}3ja90a.com
  • http://{BLOCKED}ga64aa17.com
  • http://{BLOCKED}e3oo8as0.com
  • http://{BLOCKED}1
  • http://{BLOCKED}gh716zzl.com
  • https://{BLOCKED}4cx00.cc
  • https://{BLOCKED}0300z.com
  • https://{BLOCKED}b0.com
  • https://{BLOCKED}b0.com
  • https://{BLOCKED}3.com
  • https://{BLOCKED}fda88.com

However, as of this writing, the said sites are inaccessible.

It intercepts the user's browsing data by patching part of MSWSOCK.DLL in memory, particularly, part of the APIs used for Internet connection.

It saves and posts user's browsing habit information to above-mentioned servers by checking the following strings:

  • www.google.
  • search.yahoo.com
  • www.bing.com
  • .ask.com
  • search.aol.com
  • img.youtube.com
  • upload.wikimedia.org
  • .abmr.net
  • .adbureau.net
  • .adrevolver.com
  • .aol.com
  • .aolcdn.com
  • .atdmt.com
  • .bing.com
  • .blinkx.com
  • .doubleclick.net
  • .everesttech.net
  • .fimserve.com
  • .google-analytics.com
  • .google.
  • .live.com
  • .msn.com
  • .othersonline.com
  • .powerset.com
  • .tribalfusion.com
  • .yahoo.com
  • .yieldmanager.com
  • .yimg.com

Dropping Routine

This backdoor drops the following component file(s):

  • %User Temp%\{random}.tmp - detected as TROJ_BREDO.SMXC

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Stealth Mechanism

It hooks the following APIs to hide the malware window:

  • CoCreateInstance
  • GetCursorPos

Other Details

It gets the following information from its CONFIG.INI:

  • affid
  • subid
  • version
  • installdate
  • builddate
  • rnd

It also gets the system's OS version and its locale.

It creates the mutex Global\\9e6af8f3-75f3-4b67-877a-c80125d7bc08 if the fully-qualified path of the executable file does not contain any of the following strings:

  • *explo*
  • *firefox*
  • *chrome*
  • *opera*
  • *safari*
  • *netsc*
  • *avant*
  • *browser*
  • *mozill*
  • *wuauclt*

It also creates the following mutexes:

  • Global\\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7
  • Global\\cc51461b-e32a-4883-8e97-e0706dc65415
  • Global\\3006345f-6baf-4669-a7e1-aaa310564be9

Affected Platforms

This backdoor runs on Windows 2000, XP, and Server 2003.

Analysis By: Cris Pantanilla

Updated By: Ding Plazo

Revision History:

First pattern file version: 7.532.10
First pattern file release date: Oct 12, 2010


Minimum scan engine version needed: 8.900

Pattern file needed: 7.533.00

Pattern release date: Oct 12, 2010

Important note: The "Minimum scan engine" refers to the earliest Trend Micro scan engine version guaranteed to detect this threat. However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Download the latest scan engine here.


For Windows ME and XP users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

 Step 1: Scan your computer with your Trend Micro product and note files detected as BKDR_TIDSERV.DZ 

 Step 2: Restart in Safe Mode  [learn how]

 Step 3: Search and delete the file detected as BKDR_TIDSERV.DZ  [learn how]

 Step 4: Scan your computer with your Trend Micro product to delete files detected as BKDR_TIDSERV.DZ  

*Note: If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Trend Micro offers best-of-breed antivirus and content-security solutions for your corporate network, small and medium business, mobile device or home PC.