Virus Alert: Backdoor.Nibu.H

Posted by 0 Comments

Backdoor.Nibu.H will open a backdoor Trojan component on the infected computer system. This Trojan can also perform the job of a keylogger, which periodically sends stolen information to a predefined e-mail address.

Nickname : TrojanSpy.Win32.Dumarin.c

Operating system affected:

Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

Date appeared: 17/6/2004

Describe

When executed, Backdoor.Nibu.H will perform the following actions:

1 AzSoft_watermark_small.png cong-nghe? P = 1 en_metadesc.txt en_name.txt getpageinfo.sh getpagelink.sh imglink.txt imglist.txt img.quantrimang.com label: Some Text link_original.txt link.txt log.txt meta_desc.txt name.txt news t-142619 testimg2-0.jpg testimg2-1.jpg testimg2.jpg testimg3.jpg testimg.jpg thumb tim-hieu-excel-2016-200.jpg title_vn.txt tmp02.html tmp03.html tmp2.html tmpdesc2.txt tmpdesc3.txt tmpdesc4.txt tmpdesc5.txt tmpdesc6.txt tmpdesc7.txt tmpdesc.txt tmp.html tmpresult.txt tmptrans.txt transresult.txt wm.quantrimang.com www.mailenable.com www.microsoft.com. com Manually copy to the Windows folder with the following names:

% System% dllx32.exe
% System% dlla32.exe
% Startup% dllw32.exe

Attention

& nbsp;

"% System%" is a variable and Backdoor.Nibu.H can locate the system directory and then clone itself to that location. By default, the system directory will be: C: WindowsSystem (for Windows 95/98 / Me); C: WinntSystem32 (Windows NT / 2000), or C: WindowsSystem32 (Windows XP).

& nbsp;
"% Startup%" is a variable and Backdoor.Nibu.H can locate the system directory and then clone itself to that location. For example: C: WindowsStart MenuProgramsStartup (Windows 95/98 / Me); or C: Documents and Settings <tên tại="" hiện="" khoản="" tài=""> Start MenuProgramsStartup (Windows NT / 2000 / XP).

1 AzSoft_watermark_small.png cong-nghe? P = 1 en_metadesc.txt en_name.txt getpageinfo.sh getpagelink.sh imglink.txt imglist.txt img.quantrimang.com label: Some Text link_original.txt link.txt log.txt meta_desc.txt name.txt news t-142619 testimg2-0.jpg testimg2-1.jpg testimg2.jpg testimg3.jpg testimg.jpg thumb tim-hieu-excel-2016-200.jpg title_vn.txt tmp02.html tmp03.html tmp2.html tmpdesc2.txt tmpdesc3.txt tmpdesc4.txt tmpdesc5.txt tmpdesc6.txt tmpdesc7.txt tmpdesc.txt tmp.html tmpresult.txt tmptrans.txt transresult.txt wm.quantrimang.com www.mailenable.com www.microsoft.com. com Additional Value:

"load32" = "% System% dllx32.exe" on the deep registry key so that the Trojan can automatically run when the system starts:

& nbsp;

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows
CurrentVersionRun

HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogon

[boot]

shell = explorer.exe% System% dlla32.exe

The Trojan runs when Windows 95/98 / Me starts.

Category

Virus Alert: Backdoor.Nibu.H

BRAND & CLIENTS