This backdoor may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

This backdoor drops several files. This backdoor is injected in a system process. It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run.

In WinNT, this backdoor creates multiple random CLSIDs and ShellIconOverlayIdentifiers, depending on how many times it was executed.

This backdoor opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user is able to execute commands on the affected system.



More...