A remote administration utility which bypasses normal security mechanisms to secretly control a program, computer or network.
Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.
More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.
You may also refer to the Knowledge Base on the F-Secure Community site for more information.
This backdoor program may arrive as an executable file via direct download from the Internet, or as part of a trojan-downloader or trojan-dropper payload. This malware is compressed with BeRoEXEPacker v1.00.Upon installation, the malware will create a setuplog.DLL file to contain the main malware files. It will also create a copy of itself in the setuplog.bat file, in an attempt to protect the main malware file from detection and destruction by antivirus programs.
After execution, an additional created uninstal.bat file will remove the original malware files, leaving only the setuplog.dll and setuplog.bat files.Once installed, the backdoor program first attempts to connect to a remote server, to notify the malware author that an infection has taken place.
If successfully connected, it then incrementally scans one port after another on the host machine to find an open one that would allow a remote user to connect to the infected system.
Once a remote user has gained access, any of the following actions can be performed on the infected system:
Creates these files:
Creates these processes:
These modules were loaded into other processes:
Creates these mutexes:
Attempts to download files from:
Attempts to connect to:
Sets these values:
Creates these keys: