BackDoor-DVR

Posted: March 14, 2011

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	6/10
Infected PCs:	47

First Seen:	July 24, 2009
OS(es) Affected:	Windows

BackDoor-DVR is a broad group of related backdoor Trojans. These Trojans attack the security of any PC they infect for the purpose of letting an anonymous criminal take over or damage the system. Different subtypes of BackDoor-DVR can alter running processes, change your Windows system folders or download and launch malicious software without your consent. All versions of this Trojan are rated as severe security threats, so you should remove BackDoor-DVR with high-quality security applications when you catch an infection.

BackDoor-DVR is Definitely Not a Door You Want Open on Your Computer

Infections by BackDoor-DVR may come from various regions, but the region with the highest infection rate is, by far, Saudi Arabia. Accordingly, you be careful around file sources from that country, since Saudi Arabia has more than double the BackDoor-DVR infection rate of the second highest country! This includes all major subtypes of BackDoor-DVR, rather than just one particular variation.

If your PC gets infected by BackDoor-DVR, you can expect the following attacks, at a bare minimum:

Unauthorized enumeration of processes running in memory. This is an attack where BackDoor-DVR takes note of all the processes and programs running on your machine to better attack them in the future. This enumeration not only violates your privacy and aids in other attacks, but can also degrade system performance if done excessively.
Malicious files added to your Windows system directory. Many versions of BackDoor-DVR will hide their program files in Windows folders to avoid detection. This can cause damage to existing files since BackDoor-DVR may overwrite older files with identical names. Such an unscrupulous choice in file locations also makes it difficult to remove BackDoor-DVR manually, since n incorrect file deletion can harm your operating system.
The unauthorized download or running of additional dangerous files. As a Trojan, BackDoor-DVR can download files on its own or with the guidance of a remote attacker, and then execute these files without you knowing about it. The more you wait on getting rid of BackDoor-DVR, the more time BackDoor-DVR has to weld other malicious junk to your hard drive.
Modifications of other running processes in memory. BackDoor-DVR can do this to corrupt processes and prevent them from working or to prevent itself from being detected or removed. In the worst cases, BackDoor-DVR's memory corruption techniques may be able to persist and protect BackDoor-DVR even in Safe Mode.

Nailing Shut the Door on BackDoor-DVR

All of BackDoor-DVR's attacks are dedicated towards letting remote attackers gain power over your machine or corrupting your machine with other malicious software, and so BackDoor-DVR is not a threat to take lightly. Removing BackDoor-DVR may require advanced and completely updated anti-malware applications, but since this Trojan has been known for some time, proven solutions are available.

Even if you don't see anything obviously wrong with your computer, you should delete BackDoor-DVR immediately. A remote attacker may spy on your personal information or cause subtle damage that may not be readily apparent but is still highly dangerous! Use a proven anti-malware solution, keep your preferred security applications updated, and insure the Trojan isn't running when you try to remove it, and you'll be able to take BackDoor-DVR out with minimal fuss.

Aliases

BKDR_POISON.SU [TrendMicro]Trojan Horse [Symantec]Troj/Poison-AV [Sophos]Bck/Poison.F [Panda]Win32/Injector.MY [NOD32]VirTool:Win32/Runcrypt.E [Microsoft]Riskware.Tool.Runcrypt.E [McAfee-GW-Edition]BackDoor-DVR [McAfee]Virus.Win32.Injector [Ikarus]W32/Poison.ZLM!tr.bdr [Fortinet]Win32/PoisonIvy.BA [eTrust-Vet]Win32.TrojanHorse [eSafe]BackDoor.Poison.685 [DrWeb]Backdoor.Win32.Poison.zlm [Comodo]Backdoor.Poison.zlm [CAT-QuickHeal]
More aliases (29)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

system32:vcrt80.exe

File name: system32:vcrt80.exe
Size: 40.49 KB (40492 bytes)
MD5: d0ac6124fd0bc3bccf2c178275bc94e5
Detection count: 17
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: December 11, 2009