Troj/Bdoor-JD is a backdoor Trojan for the Windows platform.
When Troj/Bdoor-JD is installed the following files are created:
<Windows>\addins\AdmDll.dll
<Windows>\addins\dtreg.exe
<Windows>\addins\license.bat
<Windows>\addins\raddrv.dll
<Windows>\addins\serv.exe
<Windows>\addins\smrs.exe
The file license.bat is also detected as Troj/Bdoor-JD. The other files are legitimate applications, including a remote server application.
The file smrs.exe is registered as a new system driver service named "pnpext", with a display name of "Universal Serial Bus Control Protocol" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\pnpext\
The following registry entry is set:
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
2