Content

BackDoor-DMV

Type
Trojan
SubType
Remote Access
Discovery Date
12/27/2007
Length
Minimum DAT
5194 (12/27/2007)
Updated DAT
5283 (04/28/2008)
Minimum Engine
5.2.00
Description Added
12/27/2007
Description Modified
08/13/2008 3:10 PM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

Upon execution, Backdoor-DMV trojan drops the following file:

  • %WinDir%\system32\netmlc.dll

(where %WinDir% is the default Windows directory, for example C:\WINNT, C:\WINDOWS etc.)

It adds the following registry keys:

HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\Control\*NewlyCreated*: 0x00000000
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\Control\ActiveService: "NWCWorkstation"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\Service: "NWCWorkstation"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\Legacy: 0x00000001
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\Class: "LegacyDriver"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\DeviceDesc: "Network Sharing Connection"

(The value of this registry key may be changed among "Removable Storage Service" or "Remote Access Manager" or "Smart Card Supply" or "Network Logon Supply")

HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\NextInstance: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\Enum\0: "Root\LEGACY_NWCWORKSTATION\0000"
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\Enum\Count: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\Enum\NextInstance: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll: "%SystemRoot%\system32\netmlc.dll"
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\Type: 0x00000020
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\Start: 0x00000002
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\ErrorControl: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\ImagePath: "%SystemRoot%\System32\svchost.exe -k netsvcs"
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\DisplayName: "Network Sharing Connection"
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\ObjectName: "LocalSystem"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PROCEXP100\0000\Control\ActiveService: "PROCEXP100"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\Control\*NewlyCreated*: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\Control\ActiveService: "NWCWorkstation"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\Service: "NWCWorkstation"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\Legacy: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\Class: "LegacyDriver"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\DeviceDesc: "Network Sharing Connection"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\Enum\0: "Root\LEGACY_NWCWORKSTATION\0000"
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\Enum\Count: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\Enum\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\Parameters\ServiceDll: "%SystemRoot%\system32\netmlc.dll"
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\Type: 0x00000020
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\ErrorControl: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\ImagePath: "%SystemRoot%\System32\svchost.exe -k netsvcs"
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\DisplayName: "Network Sharing Connection"
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\ObjectName: "LocalSystem"

It may attempt to connect with the following remote servers;

  • 64.235.44.47
  • oandpsoftware.com

Symptoms

  • existence of Registry keys files detailed above
  • existence of the dropped file described above
  • network connection described above

Method of Infection

Removal

Use the latest Engine/Dats

Variants

Variants

    N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

Characteristics -

Upon execution, Backdoor-DMV trojan drops the following file:

  • %WinDir%\system32\netmlc.dll

(where %WinDir% is the default Windows directory, for example C:\WINNT, C:\WINDOWS etc.)

It adds the following registry keys:

HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\Control\*NewlyCreated*: 0x00000000
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\Control\ActiveService: "NWCWorkstation"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\Service: "NWCWorkstation"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\Legacy: 0x00000001
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\Class: "LegacyDriver"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\0000\DeviceDesc: "Network Sharing Connection"

(The value of this registry key may be changed among "Removable Storage Service" or "Remote Access Manager" or "Smart Card Supply" or "Network Logon Supply")

HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_NWCWORKSTATION\NextInstance: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\Enum\0: "Root\LEGACY_NWCWORKSTATION\0000"
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\Enum\Count: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\Enum\NextInstance: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll: "%SystemRoot%\system32\netmlc.dll"
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\Type: 0x00000020
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\Start: 0x00000002
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\ErrorControl: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\ImagePath: "%SystemRoot%\System32\svchost.exe -k netsvcs"
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\DisplayName: "Network Sharing Connection"
HKLM\SYSTEM\ControlSet001\Services\NWCWorkstation\ObjectName: "LocalSystem"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PROCEXP100\0000\Control\ActiveService: "PROCEXP100"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\Control\*NewlyCreated*: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\Control\ActiveService: "NWCWorkstation"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\Service: "NWCWorkstation"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\Legacy: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\ConfigFlags: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\Class: "LegacyDriver"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\DeviceDesc: "Network Sharing Connection"
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\Enum\0: "Root\LEGACY_NWCWORKSTATION\0000"
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\Enum\Count: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\Enum\NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\Parameters\ServiceDll: "%SystemRoot%\system32\netmlc.dll"
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\Type: 0x00000020
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\ErrorControl: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\ImagePath: "%SystemRoot%\System32\svchost.exe -k netsvcs"
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\DisplayName: "Network Sharing Connection"
HKLM\SYSTEM\CurrentControlSet\Services\NWCWorkstation\ObjectName: "LocalSystem"

It may attempt to connect with the following remote servers;

  • 64.235.44.47
  • oandpsoftware.com

Symptoms

Symptoms -

  • existence of Registry keys files detailed above
  • existence of the dropped file described above
  • network connection described above

Method of Infection

Method of Infection -

Removal -

Removal -

Use the latest Engine/Dats

Variants

Variants -

    N/A