W32/Backdr-BP is a worm for the Windows platform.
W32/Backdr-BP includes functionality to run automatically.
W32/Backdr-BP attempts to download code from the internet.
When run W32/Backdr-BP copies itself to:
<Root>\RECYCLER\S-1-5-21-7422986323-0136121802-949708864-0829\wnzip32.exe
The following registry entry is set:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Taskman
<Root>\RECYCLER\S-1-5-21-7422986323-0136121802-949708864-0829\wnzip32.exe
The following registry entry was changed:
HKLM\SOFTWARE\Microsoft\PCHealth\PchSvc DataCollection
- 20100301230359.000000-000
+ 20100303124011.000000-000