Additional Details
The following information can be obtained using RCServ backdoor:
1. Basic system information and network configuration
2. Network passwords (for shares)
3. All keyboard activities (keylogger DLL is dropped by the backdoor)
4. Screenshot of desktop window (realtime mode also possible)
5. Backdoor sessions info (to see other sessions of the server)
6. Active processes list
7. Log of backdoor server usage
8. Backdoor server configuration settings
Other features include:
1. FTP server control
2. File manager
3. Upgradeing of server component
4. Downloading files from the WEB
5. NetBios scanner
6. UDP flooding
7. Service manager
8. Keylogging
9. Network pinging
10. Network port scanning
11. Playing tricks (swapping mouse buttons, killing windows,
running screensaver, etc.)
12. Proxy control
All files detected as Backdoor.RCServ should be deleted from an
infected system. If some files are locked while Windows is
active, they should be deleted from pure DOS (in case of Windows
9x system) or renamed with a different extensions (.EXA for
example) with further system restart (in case of NT-based
system).
[Analysis: Alexey Podrezov; F-Secure Corp.; May 13th 2002]