Home Malware Programs Backdoors Backdoor.Win32.Floder.hc

Backdoor.Win32.Floder.hc

Posted: June 27, 2011

Backdoor.Win32.Floder.hc is a backdoor Trojan that conceals its files in a fake Recycle Bin while attacking your computer's security. A Backdoor.Win32.Floder.hc infection will launch itself automatically, transfer information to outside parties, download malicious files and stop a wide range of Windows services. Any occurrence of a Backdoor.Win32.Floder.hc infection should be considered a top-level security threat, but removing Backdoor.Win32.Floder.hc files and other components should be done with an anti-virus software-based help whenever possible.

Backdoor.Win32.Floder.hc the Recycle Bin Chameleon

Like the majority of backdoor Trojans, Backdoor.Win32.Floder.hc will run automatically but tries to conceal its presence while doing so. One relatively unique method that Backdoor.Win32.Floder.hc employs to do this is its creation of a fake Recycle Bin that functions in most respects identically to a real one. Backdoor.Win32.Floder.hc will conceal its .exe file in this fake Recycle Bin to prevent you from noticing it and blocks all attempts at deleting Backdoor.Win32.Floder.hc-related files.

Some other malicious behaviors that are linked to Backdoor.Win32.Floder.hc include:

  • Backdoor.Win32.Floder.hc may use multiple ports, especially port 3800, to send information to remote parties. This can allow Backdoor.Win32.Floder.hc to announce that your PC is infected or let Backdoor.Win32.Floder.hc share private information, such as passwords, with anonymous criminals.
  • Backdoor.Win32.Floder.hc may also receive information or download files onto your PC. This can result in the presence of other malicious programs such as keyloggers or worms.
  • Most prominently, Backdoor.Win32.Floder.hc Trojans will alter your system settings to stop many different security-related Windows services. Some known targets of this Backdoor.Win32.Floder.hc attack include but aren't limited to Windows Audio, Error Reporting Service, Network Connections, Remote Access Connection Manager, System Event Notification, Security Center, Automatic Updates and Wireless Zero Configuration.
  • Backdoor.Win32.Floder.hc will create fake Windows processes to conceal its memory processes as well as its files. Backdoor.Win32.Floder.hc Trojans are particularly known for making heavy use of a fake svchost.exe process. Multiple svchost.exe processes are always active in any standard Windows environment.

Tossing Backdoor.Win32.Floder.hc into Your Real Trash Bin

The serious security threat that Backdoor.Win32.Floder.hc presents should be removed from your PC with expediency, whenever possible. Unfortunately, simply deleting Backdoor.Win32.Floder.hc's fake Recycle Bin or other visible parts of the Backdoor.Win32.Floder.hc threat will not fully remove the infection and may cause other system errors to occur.

To delete Backdoor.Win32.Floder.hc properly, it's recommended that you boot from an external device or use Safe Mode to avoid triggering Backdoor.Win32.Floder.hc's startup routine. After doing this, you can remove Backdoor.Win32.Floder.hc by using any available security software.

Update your anti-virus scanners before scanning your computer for Backdoor.Win32.Floder.hc, since Backdoor.Win32.Floder.hc is a recent threat as of June 2011. Inadequately-updated scanners may be unable to detect or get rid of Backdoor.Win32.Floder.hc. Using a full system scan option instead of a 'quick scan' is also suggested, since Backdoor.Win32.Floder.hc contains sophisticated components that may avoid detection by less rigorous methods.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\Ybxaxy.exe
    2 c:\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013\acleaner.exe
    3 c:\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]HKEY..\..\..\..{RegistryKeys}Taskman = "c:\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013\acleaner.exe"Ybxaxy = "%AppData%\Ybxaxy.exe"
Loading...