Home Malware Programs Backdoors Generic BackDoor.bfr!

Generic BackDoor.bfr!

Posted: July 19, 2011

Generic BackDoor.bfr is a variant of the common Bifrose Trojan that reduces your computer's security to allow remote hackers to take over your PC. Generic BackDoor.bfr's activities can also be used to install other malicious programs, spy on private information or change system settings without your consent. Like all backdoor Trojans, Generic BackDoor.bfr has the potential to be extremely dangerous and should be deleted as quickly as possible, before Generic BackDoor.bfr has a chance to invite criminals to harm your computer.

Generic BackDoor.bfr: a New Member of a Vast Hoard of Security-Hating Trojans

Despite the unassuming label, Generic BackDoor.bfr is extremely new and has a well-defined pedigree, being a variant of prolific Bifrose backdoor Trojans. Some examples of other backdoor Trojans with a similar structure and history include Backdoor.Win32.Bifrose.ahfs, Backdoor.Win32.Bifrose.fqm and Win-Trojan/Bifrose.32256.T.

Keeping your anti-virus software updated for recent threats may help you avoid being harmed by Generic BackDoor.bfr attacks. In particular, if your updates are dated earlier than July of 2011, you should update your security software, which is when Generic BackDoor.bfr first started to surface.

Generic BackDoor.bfr has been seen primarily in India and Austria, although other countries, especially European ones, have also seen a minor distribution of Generic BackDoor.bfr infections. If you avoid contact with file sources from those areas and practice basic safe Internet behavior, your chances of being infected with Generic BackDoor.bfr are minimal.

However, if you're unlucky enough to be infected with Generic BackDoor.bfr, the consequences for your PC security could be severe, as noted below.

What Generic BackDoor.bfr Does to Your Security to Earn Its Bad Reputation

Generic BackDoor.bfr tries to run itself automatically and without being seen, and exploits your Windows Registry to do this. These changes may not be removed, even if you delete all Generic BackDoor.bfr files, which is why using good anti-malware programs to delete Generic BackDoor.bfr is preferable to manual deletion.

While it runs, Generic BackDoor.bfr will change your security settings by opening ports, disabling or hindering your firewall and turning off a variety of security-related Windows functions. Most of these attacks will also use the Windows Registry and can continue to occur even if you've deleted Generic BackDoor.bfr, which is why properly removing Generic BackDoor.bfr is crucial.

All of the above are intended to let Generic BackDoor.bfr be a pathway for criminals to walk right up to your computer and take whatever they want, whether it's forcing the PC to perform DDoS crimes, stealing passwords and other private information or even destroying files. The possible Generic BackDoor.bfr attacks are, ultimately, limited only by the competence of the hacker that Generic BackDoor.bfr contacts.

Safe Mode may allow you to turn Generic BackDoor.bfr off and prevent itself from launching from Generic BackDoor.bfr's own power. However, this is only a stopgap measure that should be used until you can remove Generic BackDoor.bfr and all related system changes.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %TEMP%\5c7e9fe9a500535e4406f8e07aa5fcdcedec96d7

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\SOFTWARE\BIFROST\HKEY_LOCAL_MACHINE\SOFTWARE\BIFROST\HKEY_LOCAL_MACHINE\SOFTWARE\MYCROSNFT\HKEY_LOCAL_MACHINE\SOFTWARE\MYCROSNFT\ACTIVE SETUNNINSTALLED COMPONENTS\HKEY_LOCAL_MACHINE\SOFTWARE\MYCROSNFT\ACTIVE SETUNNINSTALLED COMPONENTS\{1D4B591D-E735-C971-27E5-649F2938D557}\HKEY..\..\..\..{RegistryKeys}HKEY_CURRENT_USER\URRENTPROCESS\
Loading...