Backdoor.Berbew.T Trojan Horse

[Brad]

Backdoor.Berbew.T is a Trojan that opens a back door to allow a remote attacker unauthorized access to the compromised computer.

When Backdoor.Berbew.T is executed, it performs the following actions:

   1. Creates the following files:

          * %System%\[RANDOM NAME].dll
          * %System%\[RANDOM NAME].exe

            Or:

          * %System%\[RANDOM NAME]32.dll
          * %System%\[RANDOM NAME]32.exe

            Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

   2. Adds the value:

      "InProcServer32" = "%System%\[RANDOM NAME].dll"

      to the registry subkey:

      HKEY_CLASSES_ROOT\CLSID\{F28A40D7-AD0E-034A-C651-5F0ED76232E6}

      so that it is executed every time Windows starts.

   3. Adds the value:

      "tmp" = "[ORIGINAL TROJAN FILE NAME].exe"

      to the registry subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D

      as an infection marker.

   4. Adds the value:

      "Internet Explorer" = "{F28A40D7-AD0E-034A-C651-5F0ED76232E6}"

      to the registry subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
      ShellServiceObjectDelayLoad

   5. Opens a back door on a random port to allow the remote attacker to have unauthorized access to the compromised computer. The attacker may be able to perform the following actions on the compromised computer:

          * Start a covert proxy server
          * Download and execute remote files

   6. Uses rootkit technology to hide its processes, files, and registry subkeys.

REMOVAL INSTRUCTIONS   
See: http://securityresponse.symantec.com/avcenter/venc/data/backdoor.berbew.t.html

To delete the value from the registry
   1. Click Start > Run.
   2. Type regedit
   3. Click OK.
   4. Navigate to the subkey:

      HKEY_CLASSES_ROOT\CLSID\{F28A40D7-AD0E-034A-C651-5F0ED76232E6}

   5. In the right pane, delete the value:

      "InProcServer32" = "%System%\[RANDOM NAME].dll"

   6. Navigate to the subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D

   7. In the right pane, delete the value:

      "tmp" = "[ORIGINAL TROJAN FILE NAME].exe"

   8. Navigate to the subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
      ShellServiceObjectDelayLoad

   9. In the right pane, delete the value:

      "Internet Explorer" = "{F28A40D7-AD0E-034A-C651-5F0ED76232E6}"

  10. Exit the Registry Editor.