Troj/Bckdr-QMP is a backdoor Trojan for the Windows platform.
Troj/Bckdr-QMP includes functionality to:
- download files from a remote website and run it
- add or change Administrator restrictions for local groups with guest previleges
- disable security and anti-virus settings
Troj/Bckdr-QMP also attempts to set the following registry entries:
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
0
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
limitblankpassworduse
0
HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1
HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1
HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SFCDisable
1
HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareWks
1