Home Malware Programs Backdoors Backdoor.Win32.DsBot.bvp

Backdoor.Win32.DsBot.bvp

Posted: August 18, 2011

Backdoor.Win32.DsBot.bvp is a backdoor Trojan that was designed for the explicit purpose of allowing infected computers to be controlled by remote hackers. The majority of Backdoor.Win32.DsBot.bvp infections that SpywareRemove.com malware experts have observed has been bundled with legitimate and pirated programs that are distributed through P2P networks and generalist software websites. Backdoor.Win32.DsBot.bvp's remote access vulnerabilities can be sources of password theft, account break-ins, infection by other forms of malicious software, disabled programs or system settings that have been altered to have a negative effect. Our malware research team strongly recommends deleting Backdoor.Win32.DsBot.bvp right away, although finding or removing Backdoor.Win32.DsBot.bvp may be nearly impossible unless you use a high-quality anti-malware scanner.
 

Backdoor.Win32.DsBot.bvp – An Attacker That's Installed on Your PC Free of Charge

Although Backdoor.Win32.DsBot.bvp's distribution methods aren't limited strictly, prominent Backdoor.Win32.DsBot.bvp attacks have been known to use bundles with other types of software, thus causing you to download Backdoor.Win32.DsBot.bvp and launch Backdoor.Win32.DsBot.bvp of your own free will, even if you don't realize that that's what you're doing. Criminal warez sites, websites with poor upload security and P2P networks are all top sources of Trojan infections like Backdoor.Win32.DsBot.bvp. Backdoor.Win32.DsBot.bvp in particular is associated with insecure Conference Freezer installation packages and often uses open-source installers like Nullsoft's NSIS.
 
Many security scanners may detect Backdoor.Win32.DsBot.bvp by its base family name, Backdoor.Win32.DsBot. The same goes for Backdoor.Win32.DsBot.bvp's close relatives, such as Backdoor.Win32.DsBot.abt, Backdoor.Win32.DsBot.jm, Backdoor.Win32.DsBot.ua or Backdoor.Win32.DsBot.acr, which all create vulnerabilities that are similar to Backdoor.Win32.DsBot.bvp's own attacks.
 
Since Backdoor.Win32.DsBot.bvp launches itself when Windows starts and makes the majority of its attacks by way of Registry entries and other concealed actions, you shouldn't expect to see Backdoor.Win32.DsBot.bvp operate in plain sight. Instead, our malware researchers suggest relying on an anti-malware program that can find Backdoor.Win32.DsBot.bvp preemptively before serious damage is inflicted on your PC.
 

Backdoor.Win32.DsBot.bvp – a Typical Backdoor Threat with an Atypical Warning Sign

Backdoor.Win32.DsBot.bvp attacks have been known to cause the following dangers, although configuration data may allow Backdoor.Win32.DsBot.bvp to engage in other forms of aggression, as well:

  • Weakened security due to open network ports, firewall exceptions or even wholesale disabling of security-related programs.
  • The presence of related infections, such as Generic.dx!vdw or Mal/Generic-A. However, Backdoor.Win32.DsBot.bvp's ability to install other malicious programs can also be configured to extend to many other types of PC threats, such as rogue security products, keyloggers, ransomware Trojans or worms.
  • Allowing remote criminals to have total control over your PC, including the ability to peruse through files or delete them, forcing your PC to engage in IRC-controlled DDoS botnet attacks or to force the system to self-destruct. Password theft and account theft, as well as financial-related spyware installations, are all likely to occur.
  • System instability, which can consist of something as mild as slowdowns or as major as total crashes. Backdoor.Win32.DsBot.bvp crashes can be joined by the following error message that our malware researchers have observed:
     
    System Shutdown
    This system is shutting down. Please save all work in progress and log off. Any unsaved changes will be lost. This shutdown was initiated by NT AUTHORITY\SYSTEM

     
    Time before shutdown: [six-digit timer]
     
    Message
    The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code 0. The system will now shut down and restart.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%CommonPrograms%\Conference Freezer 1.8\Uninstall Conference Freezer 1.8.lnk File name: %CommonPrograms%\Conference Freezer 1.8\Uninstall Conference Freezer 1.8.lnk
File type: Shortcut
Mime Type: unknown/lnk
%CommonPrograms%\Conference Freezer 1.8\Conference Freezer 1.8.lnk File name: %CommonPrograms%\Conference Freezer 1.8\Conference Freezer 1.8.lnk
File type: Shortcut
Mime Type: unknown/lnk
%CommonPrograms%\Conference Freezer 1.8\Conference Freezer 1.8 on the Web.url File name: %CommonPrograms%\Conference Freezer 1.8\Conference Freezer 1.8 on the Web.url
Mime Type: unknown/url
%ProgramFiles%\Conference Freezer 1.8\unins000.dat File name: %ProgramFiles%\Conference Freezer 1.8\unins000.dat
File type: Data file
Mime Type: unknown/dat
%ProgramFiles%\Conference Freezer 1.8\trueSpeech.ocx File name: %ProgramFiles%\Conference Freezer 1.8\trueSpeech.ocx
Mime Type: unknown/ocx
%ProgramFiles%\Conference Freezer 1.8\Packet freez.ttt File name: %ProgramFiles%\Conference Freezer 1.8\Packet freez.ttt
Mime Type: unknown/ttt
%ProgramFiles%\Conference Freezer 1.8\MSINET.OCX File name: %ProgramFiles%\Conference Freezer 1.8\MSINET.OCX
Mime Type: unknown/OCX
%ProgramFiles%\Conference Freezer 1.8\MSCOMCTL.OCX File name: %ProgramFiles%\Conference Freezer 1.8\MSCOMCTL.OCX
Mime Type: unknown/OCX
%ProgramFiles%\Conference Freezer 1.8\Confreezer 1.8.exe File name: %ProgramFiles%\Conference Freezer 1.8\Confreezer 1.8.exe
File type: Executable File
Mime Type: unknown/exe
%ProgramFiles%\Conference Freezer 1.8\yacscom.dll File name: %ProgramFiles%\Conference Freezer 1.8\yacscom.dll
File type: Dynamic link library
Mime Type: unknown/dll
%ProgramFiles%\Conference Freezer 1.8\unins000.exe File name: %ProgramFiles%\Conference Freezer 1.8\unins000.exe
File type: Executable File
Mime Type: unknown/exe

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstal\Conference Freezer 1.8_is1]
Loading...