Overview
Characteristics
When executed this Backdoor installs the following files in the system:
- %WINDIR%\wints.ini ( 49 bytes )
- %WINDIR%\timed.exe ( 20044 bytes )
- %WINDIR%\timer.exe
- c:\documents and settings\%USER%\local settings\temp\dcat.log
This trojan also configures itself to load at system startup.
Registry keys are also created as the following:
- hkey_local_machine\software\cat\myid="VMG-CLIENT/XP/WqQvXmoiFg7q"
- hkey_local_machine\software\cat
- hkey_local_machine\software\microsoft\windows\currentversion\run
\timer="%WINDIR%\timer.exe /i"
Symptoms
Presence of the files and registry keys mentioned.
The applications creates the following network connection(s):
- timed.exe server:www.google.com port:80
- timer.exe server:www.google.com port:80
The executable filename can vary.
Method of Infection
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial.
Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc.
Removal
All Users:
Use specified engine and DAT files for detection and removal.
Variants