Parent class: TrojWare

Trojans are malicious programs that perform actions which are not authorized by the user: they delete, block, modify or copy data, and they disrupt the performance of computers or computer networks. Unlike viruses and worms, the threats that fall into this category are unable to make copies of themselves or self-replicate. Trojans are classified according to the type of action they perform on an infected computer.

Class: Backdoor

Backdoors are designed to give malicious users remote control over an infected computer. In terms of functionality, Backdoors are similar to many administration systems designed and distributed by software developers. These types of malicious programs make it possible to do anything the author wants on the infected computer: send and receive files, launch files or delete them, display messages, delete data, reboot the computer, etc. The programs in this category are often used in order to unite a group of victim computers and form a botnet or zombie network. This gives malicious users centralized control over an army of infected computers which can then be used for criminal purposes. There is also a group of Backdoors which are capable of spreading via networks and infecting other computers as Net-Worms do. The difference is that such Backdoors do not spread automatically (as Net-Worms do), but only upon a special “command” from the malicious user that controls them.

Read more

Platform: Win32

Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.


Technical Details

This is a typical client-server remote administration utility that allows connection to remote computer(s) in order to manage its (their) system resources in real time (similar to "pcAnywhere" by Symantec). This utility has a "Remote-Anything" name, and it is developed and distributed by the TWD Industries company (

This program is detected and classified as a Backdoor Trojan, because it absolutely meets Backdoor behavior (see Backdoor):

  • hidden installation to the system
  • completely hides itself in the system when active
  • allows to administrate an infected system from a remote host

The server component of this program hides itself in the system and is not visible to the average user unlike other remote administration tools that:

  • have a standard installation and deinstallation procedures
  • have any visible interface (an icon in the tray-bar, for instance)

The Server

The server component does not have any visible installaton behavior: when run without any messages, it copies itself (the whole file) to the Windows directory with the SLAVE.EXE name and registers in the system registry in the auto-run section:

"RA Server"="C:\WINDOWS\Slave.exe"

As a result, the server component will be activated by Windows on each restart, and without any notification to a user.

The client

A hacker, by client component, may connect to an infected computer and has control over it: to watch a computer's desktop in real-time; to send commands to infected systems by keyboard and/or mouse; to access a file system; to reboot or shut down the computer.

Removing the Server

To remove the server component from the system, you need to run AVP with the latest updates and let it delete the server. You also need to delete the registry key manually.

You may also manually delete the registry key, reboot the computer and delete the server file SLAVE.EXE in the Windows directory.

You may also use a special removing utility that is distributed by TWD Industries at their Web site.

Important information about this utility:

Beginning with version 3.5.11, TWD Industries has made the following changes:

You can add to your product:

  • a server component that, during startup communicates what will be installed into the system
  • while the server component is operating its icon appears in the system tray
  • there is now a component designed to uninstall the server

    Version 3.5.11 and later do not treat harmful programs of the "Backdoor" type.

    Read more

    Find out the statistics of the vulnerabilities spreading in your region on

    Found an inaccuracy in the description of this vulnerability? Let us know!
  • Kaspersky Next
    Let’s go Next: redefine your business’s cybersecurity
    Learn more
    New Kaspersky!
    Your digital life deserves complete protection!
    Learn more
    Confirm changes?
    Your message has been sent successfully.