McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
Business Home → McAfee Labs → Threat Intelligence

Exploit-Realser

This page shows details and results of our analysis on the malware Exploit-Realser

Threat Detail

Malware Type: Malware

Malware Sub-type: Exploit

Discovery Date: 2003-09-16

Next Steps:

Overview


Minimum DAT

4295 (2003-09-24)

Updated DAT

4295 (2003-09-24)

 Minimum Engine

5.1.00

File Length

180258 , 45056

 Description Added

2003-09-16

Description Modified

2003-09-19

Malware Proliferation

Characteristics

Detection of Exploit-Realser was added to cover for a malicious file called real.exe (name might vary). It's a 32 bit windows PE file having a filesize of 180258 bytes. The .b variant has a filesize of 45056 bytes.

The file is a remote root exploit for systems running Realserver 8/9 and can target both Windows and Linux environments.

The files are commandline/console applications, they don't have a GUI interface.

No hidden system file changes were encountered on the system running the real.exe file. Remote Realserver systems might be remotely exploited and thus be compromised.

Symptoms

-Presence of a file called real.exe (name might vary). It's a 32 bit windows PE file having a filesize of 180258 bytes. The .b variant has a filesize of 45056 bytes.

-Compromised Realserver 8/9 systems.

-It may try to connect on port 31337 via netcat.

Method of Infection

-Compromised Realserver 8/9 systems might be exploited remotely.

-It may try to connect on port 31337 via netcat.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

But in some particular cases, the following steps need to be taken.

Please go to the Microsoft Recovery Console and restore a clean MBR.

On Windows XP:

  • Insert the Windows XP CD into the CD-ROM drive and restart the computer.
  • When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
  • Select the Windows installation that is compromised and provide the administrator password.
  • Issue 'fixmbr' command to restore the Master Boot Record
  • Follow onscreen instructions.
  • Reset and remove the CD from CD-ROM drive.


On Windows Vista and 7:

  • Insert the Windows CD into the CD-ROM drive and restart the computer.
  • Click on "Repair Your Computer".
  • When the System Recovery Options dialog comes up, choose the Command Prompt.
  • Issue 'bootrec /fixmbr' command to restore the Master Boot Record.
  • Follow onscreen instructions.
  • Reset and remove the CD from CD-ROM drive.

Variants

United States - English