Home Malware Programs Backdoors Trojan.Win32.Koutodoor

Trojan.Win32.Koutodoor

Posted: March 1, 2011

Trojan.Win32.Koutodoor is a Trojan of likely Chinese origin. Any systems victimized by Trojan.Win32.Koutodoor infections are immediately vulnerable to remote attack, since Trojan.Win32.Koutodoor announces its installation by sending relevant information to a remote address. Like many other trojans, Trojan.Win32.Koutodoor can download and install other malware, and is also noted for prominently changing the homepage of web browser programs. Deleting Trojan.Win32.Koutodoor is a task best handled by experts or security programs, since this Trojan has been identified to have multiple parts and a relatively high level of sophistication.

Trojan.Win32.Koutodoor is a Backdoor-Opener and More

Trojan.Win32.Koutodoor causes various symptoms, all of which are harmful, and some of which are more dangerous than others. Trojan.Win32.Koutodoor may serve as both a backdoor Trojan and a proper Trojan horse, lowering security to allow remote attacker-based assaults and downloading malware on its own initiative. Signs of Trojan.Win32.Koutodoor infection include activities like these:

  • The plainest sign of Trojan.Win32.Koutodoor infection is an altered web browser homepage. Trojan.Win32.Koutodoor will change the homepage to a subpage of the 9348.cn domain, a malicious site that should be avoided.
  • Accompanying this homepage change is Trojan.Win32.Koutodoor's addition of a Quick Launch shortcut to the same domain.
  • Alterations to the registry. Trojan.Win32.Koutodoor infections may not always create new entries, but they are known for deleting and modifying registry entries and values.
  • Trojan.Win32.Koutodoor may block security-oriented websites that could be used to prevent or remove infection.
  • Unauthorized inbound or outbound traffic is also almost certain to take place with Trojan.Win32.Koutodoor on your system, since the Trojan's primary purposes are to open a backdoor for remote attackers and drop other malware onto the machine.

Along with all these problems, Trojan.Win32.Koutodoor may also use rootkit techniques to make itself difficult to remove, and can be used to enable theft of information or remote attacks that can completely take over your computer.

Why It Doesn't Have to Happen to You

Practicing basic safe browsing habits will help keep Trojan.Win32.Koutodoor well away from your computer. Trojan.Win32.Koutodoor is often distributed as a fake .jpg file on malicious sites and may be downloaded and run by other trojans in turn.
 
Security programs are also likely to detect Trojan.Win32.Koutodoor under the more generic identification of Trojan.Dropper and under minor variations of its base name (depending on which components of the Trojan are detected).
 
This Trojan has multiple components and uses sophisticated means of self-preservation, so leave deleting Trojan.Win32.Koutodoor to the professionals and the professional anti-virus software. Attempting to remove Trojan.Win32.Koutodoor the 'old-fashioned way' is very likely to end in failure.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %PROGRAM_FILES%\Trojan.Win32.Koutodoor
    2 c:\Documents and Settings\All Users\Start Menu\Trojan.Win32.Koutodoor \
    3 c:\Documents and Settings\All Users\Trojan.Win32.Koutodoor \

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\Software\Trojan.Win32.Koutodoor
Loading...