Virus:BDS/Protector.CF
Date discovered:09/07/2010
Type:Backdoor Server
In the wild:Yes
Reported Infections:Low
Distribution Potential:Low
Damage Potential:Low to medium
Static file:Yes
File size:26.181 Bytes
MD5 checksum:d69602ce19a2bd1f01a1022327dbab57
IVDF version:7.10.08.239 - Thursday, July 1, 2010

 General Method of propagation:
   • No own spreading routine


Aliases:
   •  Symantec: Backdoor.Trojan
   •  Kaspersky: Backdoor.Win32.Protector.cf
   •  Sophos: Mal/Cutwail-B
   •  Microsoft: TrojanDownloader:Win32/Cutwail.BC
   •  Panda: Trj/CI.A
   •  PCTools: Backdoor.Trojan
   •  VirusBuster: Trojan.Agent.WWEU
   •  Eset: Win32/Wigon.KQ
   •  AhnLab: Win-Trojan/Downloader.26181
   •  DrWeb: Trojan.Proxy.14858
   •  Fortinet: W32/Protector.CF!tr.bdr
   •  Ikarus: Backdoor.Win32.Protector
   •  Norman: W32/Cutwail.AKN


Platforms / OS:
   • Windows 98
   • Windows 98 SE
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003
   • Windows Vista
   • Windows 7


Side effects:
   • Lowers security settings

 Files It deletes the initially executed copy of itself.

 Injection – It injects itself into a process.

    Process name:
   • svchost.exe


 File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

Description inserted by Carlos Valero Llabata on Friday, August 20, 2010
Description updated by Carlos Valero Llabata on Friday, August 20, 2010

Back . . . .