> Spyware Encyclopedia Page 12 > Backdoor.Autoupder

Backdoor.Autoupder removal

Spyware Autoupder Information
Name: Backdoor.Autoupder Category: Downloader Date: 2002-05-07 Dangerous: Yes

Backdoor.Autoupder is Downloader which is malware.
Could be used as a distribution mechanism by worms or other malicious applications. initially presents itself as a Windows Cabinet [.cab] file named CoolStuff.cab. This file contains the ActiveX control file CoolStuff.ocx & the setup data file CoolStuff.inf. This file is usually obtained by visiting a malicious Website that then attempts to download & install CoolStuff.cab to your computer. Currently, this is the only way that this Trojan is known to infect computers. Once these files ar installed, the ActiveX control checks the process list to see if any of the following applications are running: Blackice.exe [Black Ice Defender] Blackd.exe [Black Ice Defender] Zonealarm.exe [ZoneAlarm Firewall] Smc.exe [Sygate Personal Firewall] Persfw.exe [Tiny Personal Firewall] Lookout.exe [ISS Network Sniffer program] Espmonitor.exe [Esafe Protect Monitor] Mpftray.exe [McAfee Personal Firewall] Serv95.exe [Esafe Eliashim] Nisum.exe [Norton Internet Security] Nmain.exe [Norton Internet Security] If any of these processes are running, Backdoor.Autoupder will terminate itself & do nothing. Otherwise, Backdoor.Autoupder will attempt to connect to one of the following Web sites, depending on its version: http:/ /www.online1net.com/ http:/ /www.wwws1.com/au/ From one of the listed Web sites, Backdoor.Autoupder will try to download one or more of the following files & place them in the \Windows folder: Ausvc.exe. This module may also download malicious packages from one of the two listed Websites, & may install these packages on the victim´s computer. Bvt.exe. This module is referred to as the Explorer Event component. It appears to have listening functions which allow backdoor capabilities. Mnsvc.exe. This module connects to one of the two listed Websites, & checks if there are any new updated versions of the backdoor Trojan. Absr.exe. This module is referred to as the Auto Explorer component. It appears to be trying to connect to any random Website. It is possible that Backdoor.Autoupder will download other files instead. If one of the files has been downloaded successfully, Backdoor.Autoupder will terminate these processes if they are running, & execute the newly downloaded versions. Upon execution of the downloaded executables, & depending on which file was launched, Backdoor.Autoupder adds one of the following values: SysScan C:\WINDOWS\bvt.exe ausvc C:\WINDOWS\ausvc.exe ABsr C:\WINDOWS\absr.exe mnsvc C:\WINDOWS\mnsvc.exe to the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run Backdoor.Autoupder may add one or more of the following subkeys: {6541B981-2E27-46B1-A2CC-8264A75B74FE} {868B015F-3515-44DB-B0AD-182CD058985E} {9A05FE9B-5B52-4D13-A77D-FA7C38557A8E} {BAE85C97-2CD4-45C3-A1ED-E4CEF7C6AA52} {C76BE992-2BC3-41A4-8B87-A8C01FE419A7} {F53C844A-D9C8-4E92-B923-C05B46C4A7E3} {FBE091E5-DF43-4FFB-AECC-7E3A3BC7B0D9} to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID It may add the following [or other] subkeys: {8B034058-08B0-4CB3-B2E8-60238B4967F2} to the registry key HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\AppID It may add the following [or other] subkeys: {6D8B1B74-4AB8-473B-B479-253FA1936802} to the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\TypeLib Backdoor.Autoupder is also capable of checking for the presence of newer versions of itself on specific Web sites & silently updating itself. Backdoor.Autoupder has strings embedded inside its application that may refer to commands used to remotely control the victim´s computer. Installing it is highly not recommended.

This Downloader is also known as:

•Downloader-W - named by McAfee.
• security risk or a "backdoor" program - named by F-Prot.
• TROJ_SUA.A - named by -.
• Downloader W.
• TrojanDownloader.Win32.Minstaller - named by Kaspersky.
• Win32.MinStaller - named by Computer Associates.
• Win32/Autoupder trojan - named by Eset.
• Win32/Downloader-W.A.Trojan - named by Computer Associates.
• Win32/Downloader-W.B.Trojan - named by Computer Associates.
• Win32/TrojanDownloader.Minstaller trojan - named by Eset.

>> Delete Backdoor.Autoupder automatically - Download Spyware Doctor

Backdoor.Autoupder Removal Instructions
Kill the following processes ausvc.exe, mnsvc.exe
Remove the following files ausvc.exe, backdoor.autoupder.txt, mnsvc.exe.

Bookmark Backdoor.Autoupder page

Previous Spyware: Remove Backdoor.Autocrat.b

Next Spyware: Remove Backdoor.Avstral.g