Backdoor.Mepcod

[TJ]

Backdoor.Mepcod is a Trojan horse that opens a back door and downloads a file containing additional commands.

When Backdoor.Mepcod is executed, it performs the following actions:

   1. Copies itself as the following file:

      %Windir%\McAfeeScanPlus.exe.

      Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

   2. Drops the following file and opens it with mspaint.exe:

      %CurrentFolder%\me.bmp

      Note: %CurrentFolder% is a variable that refers to the folder where the risk was originally executed.

   3. Creates the following file, which is used to log account information:

      %Windir%\winlogon9.log

   4. Adds the value:

      "McAfeeScanPlus" = %Windir%\McAfeeScanPlus.exe"

      to the registry subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

      so that the risk runs every time Windows starts.

   5. Adds the value:

      "%Windir%\McAfeeScanPlus.exe" = "%Windir%\McAfeeScanPlus.exe:*:Enabled:McAfeeScanPlus"

      to the registry subkey:

      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\
      Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

      to enable the backdoor functionality.

   6. Attempts to download files from [http://]diji-realm.net/[REMOVED]/BN2005/LogMe.php

   7. Attempts to download additional commands from [http://]diji-realm.net/[REMOVED]/BN2005/binfo.txt.

REMOVAL INSTRUCTIONS
See: [url]http://securityresponse.symantec.com/avcenter/venc/data/backdoor.mepcod.html[/url]


To delete the value from the registry
   1. Click Start > Run.
   2. Type regedit

      Then click OK.
   3. Navigate to the subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

   4. In the right pane, delete the value:

      "McAfeeScanPlus" = %Windir%\McAfeeScanPlus.exe

   5. Navigate to the subkey:

      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess
      \Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

   6. In the right pane, delete the value:

      "%Windir%\McAfeeScanPlus.exe" = "%Windir%\McAfeeScanPlus.exe:*:Enabled:McAfeeScanPlus"

   7. Exit the Registry Editor.