backdoor: Backdoor.Win32.Small.cef

Risk level: Medium

virus Description

The virus samples is a backdoor developed use the “MFC”, it is used “UPolyX” way of trying to evade signature scanning packers, packers after the size of “31,894″ bytes, the icon is “”, viruses extension “exe” , mainly through the “file bundle”, ” download tools to download” “page linked to horse”, etc.,and spread, the viruses primary purpose is to control the user’s computer.
After the user’s computer was infected, the network running Slow, open network ports, file data leakage, and so on.

Infection in the operating system

Windows 2000/Windows XP / Windows 2003/Windows Vista / Windows 7

Transmission

Bundle file, web page linked to horse, download tools to download

Manually removal:

1, manually shut down the service entry named “panp”
2, manually delete the following Registry key:
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ panp
HKEY_LOCAL_MACHINE \ SYSTEM \ ControlSet001 \ Services \ panp
3, manually delete the following procedures:
% SystemRoot% \ system32 \ panp.exe

Variable declaration:

% SystemDriver% system where the partition, usually “C: \”
% SystemRoot% WINDODWS the directory, usually “C: \ Windows”
% Documents and Settings% user file directory, usually “C: \ Documents and Settings”
% Temp% temp folder, usually “C: \ Documents and Settings \ current user name \ Local Settings \ Temp”
% ProgramFiles% system program the default installation directory, typically: “C: \ ProgramFiles”
Virus

(1) virus related to open registry key, check whether they have been infected.
(2) access to the system path and its own path to copy itself to% SystemRoot% \ system32 \ panp.exe. Upon completion of its property to the system hidden attribute.
(3) to% SystemRoot% \ system32 \ panp.exe added to the name “panp” service items, and write the relevant registry values:
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ panp
Name: ImagePath
Value: C: \ WINDOWS \ system32 \ panp.exe
HKEY_LOCAL_MACHINE \ SYSTEM \ ControlSet001 \ Services \ panp
Name: ImagePath
Value: C: \ WINDOWS \ system32 \ panp.exe
(4) After the success of the virus to delete itself.
(5)% SystemRoot% \ system32 \ panp.exe to connect to the specified network hackers, waiting to take control of the computer.

Virus to create a file:

% SystemRoot% \ system32 \ panp.exe

Virus to access the network:

98.126 .***. 154:1693