Home Malware Programs Remote Administration Tools Backdoor.Netbus

Backdoor.Netbus

Posted: March 28, 2006

Also known as Backdoor.Netbus, Netbus Trojan is a serious computer threat that uses the Trojan infection format to let a remote attacker completely take over your system. Although Netbus Trojan has been floating around for years, Backdoor.Netbus remains a very serious threat, since Backdoor.Netbus grants the attacker the same privileges and rights as the current user. If you don't remove Netbus Trojan ASAP, you're giving all your information and the very operation of your machine over to an anonymous hacker, so make deleting Netbus Trojan a serious priority if you suspect its existence on your system.

What This Trojan Can Do (Without Your Permission!)

Currently Netbus Trojan is reported to be able to infect only Windows platforms up to Windows NT. However, there have been documented examples of updates and variations to Netbus Trojan, so you can't afford to relax your guard against this threat too much even if you're running a modern OS. Netbus Trojan will give as few signs possible of its existence, since its aim is to allow a stranger to control your system without your knowing how it's happening. The Netbus Trojan infection has been verified to be able to do the following:

  • Create sound-based interferences, such as playing audio files or causing a 'click' on keystrokes.
  • Transfer files, both to the hacker and from the hacker.
  • Record information and sounds, including input from the user's microphone and keyboard.
  • Take screen capture images.
  • Manipulate keyboard input by disabling certain keys or sending additional keystrokes.
  • Hijack the browser and force it towards an arbitrary website.
  • Shut down the operating system.
  • Take control over mouse input, including altering the functions of mouse buttons.
  • Create various messages, including false system alerts and warnings.
  • Open various applications and individual files such as pictures.
  • Open and close the CD drive.

What These Actions Mean for Netbus Trojan's Victim

Not being able to see Netbus Trojan running isn't a sign that you should relax, since Trojans like Netbus Trojan are intended for stealthy operation in any case. Users who let this Trojan remain instead of immediately deleting Netbus Trojan will put themselves at risk for many different problems of varying severity.

The hacker may use Netbus Trojan to record your passwords and other private account information. With this, he or she can then gain free usage of your accounts even if you delete Netbus Trojan afterwards. Netbus Trojan can also be used to download other kinds of malware such as rogue anti-virus products that have the potential to disable programs that are necessary for running your computer safely. Given that the potential for harm increases practically exponentially over time, removing Netbus Trojan isn't something one should put off, no matter how little the infection appears to be hurting you. Netbus Trojan has been documented to be spread through game bundles such as 'Whackamole' in addition to the usual methods, so be careful about what you download from untrustworthy sources!

Aliases

NetBus.reg (McAfee),
Troj/NetBus-REG (Sophos),
REG_NETBUP.A (Trend Micro)

File System Modifications

  • The following files were created in the system:
    # File Name
    1 -1482685340.exe
    2 -722545794.exe
    3 310fd342.exe
    4 3390efcf.exe
    5 backdoor.netbus.12.exe
    6 backdoor.netbus.170.exe
    7 backdoor.netbus.170_(210).exe
    8 backdoor.netbus.170_(343).exe
    9 backdoor.netbus.170_(45).exe
    10 nbnts1.reg
    11 nbs1.reg

Related Posts

Loading...