A remote administration tool (RAT) that bypasses the security features of a program, computer or network to give unauthorized access or control to its user.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
This backdoor program may arrive as an executable file via direct download from the Internet, or as part of a trojan-downloader or trojan-dropper payload. This malware is compressed with BeRoEXEPacker v1.00.Upon installation, the malware will create a setuplog.DLL file to contain the main malware files. It will also create a copy of itself in the setuplog.bat file, in an attempt to protect the main malware file from detection and destruction by antivirus programs.
After execution, an additional created uninstal.bat file will remove the original malware files, leaving only the setuplog.dll and setuplog.bat files.Once installed, the backdoor program first attempts to connect to a remote server, to notify the malware author that an infection has taken place.
If successfully connected, it then incrementally scans one port after another on the host machine to find an open one that would allow a remote user to connect to the infected system.
Once a remote user has gained access, any of the following actions can be performed on the infected system:
Creates these files:
Creates these processes:
These modules were loaded into other processes:
Creates these mutexes:
Attempts to download files from:
Attempts to connect to:
Sets these values:
Creates these keys: