Home Malware Programs Trojans Trojan.Win32.Pakes.ofu

Trojan.Win32.Pakes.ofu

Posted: February 22, 2011

Trojan.Win32.Pakes.ofu is a botnet Trojan that subverts infected systems to use them for illegal DDoS (Distributed Denial of Service) attacks on websites. To have the misfortune of hosting Trojan.Win32.Pakes.ofu means that your security is greatly reduced, since this Trojan joins an IRC server and channel without permission and may send data to that channel. Trojan.Win32.Pakes.ofu also changes your registry to run with every system start, so don't assume that Trojan.Win32.Pakes.of is not there just because you don't see it.

Did Trojan.Win32.Pakes.ofu Drill Through Your Security?

So far the top vulnerability for Trojan.Win32.Pakes.ofu infections has been shown to be local network issues. If your machine is set up on a local network and you have poor security for it, then Trojan.Win32.Pakes.ofu may infect you even if you take care not to download files from the Internet carelessly. If Trojan.Win32.Pakes.ofu does get on, you'll find your security problems expanding to far more noticeable levels.

Trojan.Win32.Pakes.ofu will use the good old malware tradition of changing your registry to let itself start up whenever Windows itself starts. This will not be immediately visible, and may only be detected at all in some cases through finding the extra malware process in Task Manager. Trojans like Trojan.Win32.Pakes.ofu can disable Task Manager or name themselves after normal Windows processes to try and fool you, however, so don't be caught off guard.

Trojan.Win32.Pakes.ofu creates backdoor security risks that riddle your security settings into Swiss cheese. This can be used for the purpose of downloading other malware, as is typically the wont of Trojans like Trojan.Win32.Pakes.ofu. More malevolently, backdoors can also let in remote attackers.

Don't Become Part of this Zombie Army

Computers infected by Trojan.Win32.Pakes.ofu are likely to be recruited to serve in a 'zombie army,' or a network of infected computers that are controlled by remote attackers for malicious purposes. This botnet, as it's also known, is usually turned towards DDoS attacks, which flood servers with so much activity that they shut down under the strain.

These types of attacks have been known to shut down even major websites such as PayPal and sites belonging to credit card companies. Although such attacks are usually limited and temporary in their damage, DDoS attacks remain dangerously potent when used strategically. In all cases, DDoS attacks will take control of the infected computers in the zombie army away from the actual owners of those systems.

The same programs that enable automated DDoS attacks may also be used for other harmful acts. Not deleting Trojan.Win32.Pakes.ofu when you catch Trojan.Win32.Pakes.ofu tugging the strings of your system is letting a remote attacker do whatever he wants with your machine; given that Trojan.Win32.Pakes.ofu hasn't been documented to have unusual defenses against good security software, such neglect would be difficult to excuse and ultimately self-destructive.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\addons.dat
    2 %ProgramFiles%\Bifrost\logg.dat
    3 %ProgramFiles%\Bifrost\server.exe
    4 %Temp%\0.exe
    5 %Temp%\1.flv

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\BifrostHKEY_LOCAL_MACHINE\SOFTWARE\BifrostHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{144D3081-A392-563B-1249-453A24D1989F}HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideoHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
Loading...