Threat Description



Category: Malware
Platform: W32
Aliases: Petala, Backdoor.Petala


Petala backdoor (hacker's remote tool) was first found on 28th of September 2003. The backdoor provides a limited access to an infected system for remote hackers. The backdoor originate from Brasil.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

The backdoor is written in Visual Basic. Its file is 331 kilobytes long and has VB P-Code instead of normal Assembly instructions.

Techical details

When the backdoor's file is run, it installs itself to system. The backdoor copies itself to Windows folder as WINDATA.EXE file and to Windows System folder as MSJIS.EXE file. The backdoor creates startup keys for both these files in System Registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN]  "Microsoft Network Registry Control" = "%windir%\system\msjis.exe"  [HKEY_USERS\S-1-5-21-484763869-746137067-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Run]  "Environ Monitor" = "%windir%\system\msjis.exe"  [HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN]  "Microsoft Network Control" = "%windir%\windata.exe"  [HKEY_USERS\S-1-5-21-484763869-746137067-854245398-1003\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run]  @ = "%windir%\windata.exe"  

The backdoor can also modify WIN.INI file to make its files start during every Windows session.

The backdoor can create the following files in Windows folder:

msjet.sys  navrs.sys  regbck.sys  

The backdoor replaces SCRIPT.INI file of mIRC client with its own one. The new file instructs an IRC client to send the following message to all users joining a channel where an infected person is present:

Tranforme seu WINDOWS numa super estacao de trabalho interligada  24h na internet com os melhores servicos gr¡tis. Desde  televis£o, cinema, ate jogos e supermercado, locadora, acougue,  farm¡cia de todo brasil. Algo realmente nunca visto antes. E  tudo com um simples update e com a garantia da microsoft.  Confira:  

We believe that the backdoor's author wanted the backdoor to spread through IRC networks, but this functionality was not completed for some reason.

The backdoor can be controlled using an IRC bot. Additionally the backdoor has a built-in FTP server and mail relay. A hacker can do the following actions using the backdoor:

Login to backdoor  Change bot's nick  Join or part a channel  Send text message  Set channel mode  Start file  Delete file  Copy file  Send SPAM  Change IDENT  Give or take voice (prefered user)  Give or take op (channel operator)  Ban or unban user  Ignore user  Uninstall backdoor  Send URL  Get process list  Kill specified process  List files on an infected hard drive  Start frp server  

The backdoor kills the following files:

%windir%\menu iniciar\programas\iniciar\wd.exe  %windir%\Start Menu\Programs\StartUp\wd.exe  %sysdrv%\Documents And Settings\All Users\Menu Iniciar\Programas\Inicializar\wd.exe  

where %sysdrv% is system drive and %windir% is Windows folder.

The backdoor deletes files and terminates processes with the following names:

vsmon.exe  minilog.exe  zapro.exe  avgserv.exe  symtray.exe  wingate.exe  persfw.exe  vsstat.exe  vshwin32.exe  webscan.exe  rulaunch.exe  mcshield.exe  wg2eng95.exe  nprotect.exe  avgserv9.exe  pstores.exe  avgcc32.exe  wg3eng9x.exe  navapw32.exe  wengmon.exe  cjinject.exe  ccevtmgr.exe  navapw32.exe  poproxy.exe  proxy.exe  csinsm32.exe  monwow.exe  cmgrdian.exe  avconsol.exe  avsynmgr.exe  


F-Secure Anti-Virus detects Petala with the update released on September 29th, 2003:

Detection Type: PC
Database: 2003-09-29_02

Description Details: Alexey Podrezov; 29th of September, 2003


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More