Sophos

Troj/Haxdoor-O

Aliases
  • Backdoor.Win32.Haxdoor.ax
  • BackDoor-BAC.dll
  • BackDoor-BAC.gen
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Drops more malware
  • Installs itself in the registry
Protection available since 6 December 2004 13:37:30 (GMT)
Detected by All Sophos products
Download Free virus scan
Download the Threat Detection Test
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

Troj/Haxdoor-O is a member of the Troj/Haxdoor family of backdoor Trojans for the Windows platform that provide unauthorised remote access to the infected computer.

The installation executable for Troj/Haxdoor-O drops the following Trojan files to the Windows system folder (not all of these files may be installed under Windows 95/98/ME):

cm.dll
draw32.dll
hm.sys
klogini.dll
memlow.sys
p2.ini
vdnt32.sys
wd.sys

(where klogini.dll and p2.ini are log text files.)

In order to be able to run automatically when Windows starts up, Troj/Haxdoor-O sets the following registry entries on NT-based versions of Windows where the the service name and driver name correspond to the created service and driver:

Winlogon Notify:
name = draw32
path = draw32.dll
notifyfunction = "MedManager"
Service process:
servicename = memlow
displayname = "LMMngr"
imagepath = "memlow.sys "
Driver:
drivername = vdnt32
displayname = "MemDRV"
imagepath = "vdnt32.sys"

Troj/Haxdoor-O sets a number of registry entries including the following:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\draw32\
DllName
Startup
Impersonate
Asynchronous
MaxWait

HKLM\SYSTEM\ControlSet001\Control\
Impersonate
StackSize
Session Manager\Memory Management\EnforceWriteProtection

HKLM\SYSTEM\ControlSet001\Services\memlow\
Type
Start
ErrorControl
ImagePath
DisplayName
Security\
Security\Security

HKLM\SYSTEM\ControlSet001\Services\vdnt32\
Type
Start
ErrorControl
ImagePath
DisplayName
Security
Security\Security

HKLM\SYSTEM\CurrentControlSet\Control\
Impersonate
StackSize
Session Manager\Memory Management\EnforceWriteProtection

HKLM\SYSTEM\CurrentControlSet\Services\memlow\
Type
Start
ErrorControl
ImagePath
DisplayName
Security\
\Security\Security

HKLM\SYSTEM\CurrentControlSet\Services\vdnt32\
Type
Start
ErrorControl
ImagePath
DisplayName
Security\
Security\Security

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer