A remote administration utility which bypasses normal security mechanisms to secretly control a program, computer or network.
Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.
More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.
You may also refer to the Knowledge Base on the F-Secure Community site for more information.
This backdoor program attempts to connect to a remote IRC server. It also attempts a Denial-of-Service (DoS) exploit on any machines it finds with an open Microsoft-ds (Directory Service) port.
During installation, the following files are created:
While active, the backdoor attempts to connect to a remote IRC server:
The backdoor also iterates the IP address and looks for available systems with an open Microsoft-ds port (specifically, tcp 445). If a vulnerable machine is discovered, the backdoor breaches the targeted machine's Windows Firewall, a form of Denial-of-Service (DoS) exploit similar to the notorious MS04-011 vulnerability.To protect the backdoor, the WMISRV Service is stopped when the debugger program Ollydbg is launched; this protective action makes the debugging process more difficult.
The backdoor edits the Windows Firewall Policy, to allow it to function as an authorized application.
It also sets two malware launch points as services:
The following mutex name is used by wmisvr.exe: