Troj/Bckdr-RBN is a Trojan for the Windows platform.
Troj/Bckdr-RBN includes functionality to:
- run automatically
- modify personal firewall settings
- access the internet and communicate with a remote server via HTTP
Troj/Bckdr-RBN communicates via HTTP with the following locations:
cupda . in
modsm . com
The following registry entry is set, affecting internet security:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
\StandardProfile\AuthorizedApplications\List
<path to file>\pdfupd.exe:*:Enabled:ldrsoft
Registry entries are created under:
HKCU\Software\Microsoft\idl
<random digits and letters>
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\start 1
<path to file>\pdfupd.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\start 2
<path to file>\pdfupd.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\start 3
<path to file>\pdfupd.exe