Home Malware Programs Trojans Backdoor.Cycbot!gen2

Backdoor.Cycbot!gen2

Posted: November 17, 2010

Backdoor.Cycbot!gen2 is a malicious Trojan that may represent security risk for the compromised system or its network environment. Backdoor.Cycbot!gen2 contains a potentially unwanted adware program designed to deliver various advertisements to the infected system. Another program downloads files to the local computer that may represent security risk. Backdoor.Cycbot!gen2 also allows remote access to the compromised system and comes armed with a keylogger program that can capture all user keystrokes, including confidential details such usernames, passwords and credit card numbers. Remove Backdoor.Cycbot!gen2 immediately before it starts wreaking havoc on your system.

Aliases

BackDoor-EXI (McAfee)
Win-Trojan/Downloader.107008.CP (AhnLab)

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\Microsoft\stor.cfg
    2 %AppData%\Microsoft\svchost.exe
    3 %AppData%\Microsoft\Windows\shell.exe
    4 %Temp%\dwm.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows][HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current\Software\Microsoft\windows\CurrentVersion\Internet Settings][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current\Software\Microsoft\windows\CurrentVersion\Internet Settings]
Loading...