Threat Database Backdoors Backdoor.Proxybox

Backdoor.Proxybox

By ZulaZuza in Backdoors

Threat Scorecard

Threat Level: 60 % (Medium)
Infected Computers: 54
First Seen: July 10, 2012
OS(es) Affected: Windows

Backdoor.Proxybox is a backdoor Trojan able to open a back door and allow a hacker to gain remote access on poorly protected computers. Trojans are stealth and can not only open a port to communicate with a C&C server, but can also make systems changes comparable to that of a programmer or IT expert. Trojans use common vectors to gain deceptive entry, often hiding behind faces (i.e. interfaces and prompts) claiming to be innocent or of great help. Studies show most malware invasions occur when victims click too fast and fail to fortify their systems with proper security. After slipping inside, Backdoor.Proxybox will set up shop by executing files, adding registry entries, including one that runs the malicious executable each time Windows is booted, and by performing its main function, opening a backdoor. An open port could allow more malware to be downloaded, such as a keylogger or a rogue security program.

Backdoor.Proxybox is without an interface and was intended to work resident in the background. If your system is suddenly running slow, web pages freezing up or you've been notified Backdoor.Proxybox is present, you should react swiftly by using a stealth anti-malware to uproot and permanently remove all hidden malware.

Aliases

15 security vendors flagged this file as malicious.

Anti-Virus Software Detection
Panda Generic Malware
AVG BackDoor.Agent.ARMF
Fortinet W32/Agent.DEOE!tr.rkit
Ikarus Trojan.Rootkit
Antiy-AVL Trojan/Win32.Agent.gen
AntiVir TR/Rootkit.Gen
DrWeb Trojan.NtRootKit.14541
Comodo UnclassifiedMalware
Sophos Mal/Generic-L
Kaspersky Rootkit.Win32.Agent.deoe
eSafe Win32.Backdoor.Proxy
Avast Win32:Malware-gen
Symantec Backdoor.ProxyBox
K7AntiVirus RootKit
McAfee Generic.dx!bf3j

SpyHunter Detects & Remove Backdoor.Proxybox

File System Details

Backdoor.Proxybox may create the following file(s):
# File Name MD5 Detections
1. rxsupply.sys 86908d0c072ce28a7650b78bab5a06e5 54
2. %SystemDrive%\Documents and Settings\All Users\Application Data\Adobe\sp.dll
3. %SystemDrive%\Documents and Settings\All Users\Application Data\Adobe\rxsupply.sys
4. %SystemDrive%\Documents and Settings\All Users\Application Data\Adobe\fs.cfg
5. 7_24e5ba.exe 24e5ba364afcaa1a4754a8902301c312 0

Registry Details

Backdoor.Proxybox may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\"Type" = "110"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\"netsvc" = "SPService, J"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\Parameters\"ServiceDll" = "%SystemDrive%\Documents and Settings\All Users\Application Data\Adobe\sp.dll""
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\Enum\"0" = "Root\LEGACY_SHTST\0000"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{96AFBE69-C3B0-4b00-8578-D933D2896EE2}" = "sp"
HKEY_CLASSES_ROOT\CLSID\{96AFBE69-C3B0-4b00-8578-D933D2896EE2}\InProcServer32\"(Default)" = "%SystemDrive%\Documents and Settings\All Users\Application Data\Adobe\sp.DLL"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\Enum\"Count" = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\"ObjectName" = "LocalSystem"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%System%\svchost.exe" = "%System%\svchost.exe:*:Enabled:svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\"netsvc" = "SPService, m"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\"ImagePath" = "%System%\svchost.exe -k netsvc"
"{96AFBE69-C3B0-4b00-8578-D933D2896EE2}"
HKEY_CLASSES_ROOT\sp\CLSID\"(Default)" = "{96AFBE69-C3B0-4b00-8578-D933D2896EE2}"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\Enum\"NextInstance" = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\"ErrorControl" = "1"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%System%\svchost.exe" = "%System%\svchost.exe:*:Enabled:svchost.exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FsFilter\"ImagePath" = "%SystemDrive%\Documents and Settings\All Users\Application Data\adobe\rxsupply.sys"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\Parameters\"ServiceDll" = "%SystemDrive%\Documents and Settings\All Users\Application Data\Microsoft\sp.DLL"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\sp\"(Default)" =
HKEY_CLASSES_ROOT\CLSID\{96AFBE69-C3B0-4b00-8578-D933D2896EE2}\InProcServer32\"(Default)" = "%SystemDrive%\Documents and Settings\All Users\Application Data\Microsoft\sp.DLL"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPService\"Start" = "2"

Trending

Most Viewed

Loading...