Troj/Bdoor-AMC is a Trojan which allows a remote intruder to gain access and control over the computer.
Troj/Bdoor-AMC includes functionality to access the internet and communicate with a remote server via HTTP.
When first run Troj/Bdoor-AMC copies itself to:
<Startup>\userinit.exe
<User>\svchost.exe
<System>\drivers\services.exe
and creates the following files:
<User>\explorer.dll
<System>\explorer.dll
The files named explorer.dll are detected as Troj/Bckdr-QNZ.
The following registry entries are created to run Troj/Mdrop-BTJ on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
[system]
<System>\drivers\services.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
winlogon
<User>\svchost.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[system]
<System>\drivers\services.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
winlogon
<User>\svchost.exe
The following registry entry is changed to run Troj/Mdrop-BTJ on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
<System>\userinit.exe,<System>\drivers\services.exe
The following registry entry is set or modified, so that services.exe is run when files with extensions of EXE are opened/launched:
HKCR\exefile\shell\open\command
(default)
<System>\drivers\services.exe "%1" %*
The file <System>\drivers\services.exe is registered as a service named "Schedule" (replacing any existing services named "Schedule"). Registry entries are created or modified under:
HKLM\SYSTEM\CurrentControlSet\Services\Schedule