Class | Backdoor |
Platform | Win32 |
Description |
Technical DetailsThis is a typical client-server remote administration utility that allows connection to remote computer(s) in order to manage its (their) system resources in real time (similar to “pcAnywhere” by Symantec). This utility has a This program is detected and classified as a Backdoor Trojan, because it absolutely meets Backdoor behavior (see Backdoor):
The server component of this program hides itself in the system and is not visible to the average user unlike other remote administration tools that:
The ServerThe server component does not have any visible installaton behavior: when run without any messages, it copies itself (the whole file) to the Windows directory with the SLAVE.EXE name and registers in the system registry in the auto-run section:
As a result, the server component will be activated by Windows on each restart, and without any notification to a user. The clientA hacker, by client component, may connect to an infected computer and has control over it: to watch a computer’s desktop in real-time; to send commands to infected systems by keyboard and/or mouse; to access a file system; to Removing the ServerTo remove the server component from the system, you need to run AVP with the latest updates and let it delete the server. You also need to delete the registry key manually. You may also manually delete the registry key, reboot the computer and delete the server file SLAVE.EXE in the Windows directory. You may also use a special removing utility that is distributed by TWD Industries at their Web site. Important information about this utility: Beginning with version 3.5.11, TWD Industries has made the following changes: You can add to your product: Version 3.5.11 and later do not treat harmful programs of the “Backdoor” type. |
Find out the statistics of the threats spreading in your region |