Virus Database

Backdoor.RA-based

Description Backdoor.RA-based

This is a typical client-server remote administration utility that allows connection to remote computer(s) in order to manage its (their) system resources in real time (similar to "pcAnywhere" by Symantec). This utility has a "Remote-Anything" name, and it is developed and distributed by the TWD Industries company (http://www.twd-industries.com).
This program is detected and classified as a Backdoor Trojan, because it absolutely meets Backdoor behavior (see Backdoor):
hidden installation to the system
completely hides itself in the system when active
allows to administrate an infected system from a remote host
The server component of this program hides itself in the system and is not visible to the average user unlike other remote administration tools that:
have a standard installation and deinstallation procedures
have any visible interface (an icon in the tray-bar, for instance)
The Server
The server component does not have any visible installaton behavior: when run without any messages, it copies itself (the whole file) to the Windows directory with the SLAVE.EXE name and registers in the system registry in the auto-run section:
[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServices]
"RA Server"="C:\WINDOWS\Slave.exe"
As a result, the server component will be activated by Windows on each restart, and without any notification to a user.
The client
A hacker, by client component, may connect to an infected computer and has control over it: to watch a computer's desktop in real-time; to send commands to infected systems by keyboard and/or mouse; to access a file system; to reboot or shut down the computer.
Removing the Server
To remove the server component from the system, you need to run AVP with the latest updates and let it delete the server. You also need to delete the registry key manually.
You may also manually delete the registry key, reboot the computer and delete the server file SLAVE.EXE in the Windows directory.
You may also use a special removing utility that is distributed by TWD Industries at their Web site.
Important information about this utility:
Beginning with version 3.5.11, TWD Industries has made the following changes:
You can add to your product:

a server component that, during startup communicates what will be installed into the system
while the server component is operating its icon appears in the system tray
there is now a component designed to uninstall the server
Version 3.5.11 and later do not treat harmful programs of the "Backdoor" type.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.CMD

Description Macro.Word97.CMD

This is a stealth macro-virus. It contains six macros: AutoOpen, AutoClose, ToolsMacro, FileSaveAs, FileTemplates, and ViewVBCode.
The virus replicates itself when documents are opened, closed or saved with a new name (AutoOpen, FileClose, FileSaveAs). The virus disables the VirusProtection option.
Upon entering the Tools/Macro and File/Tamplates menus, it displays the Balloon:
Help
You do not have permission to do this. Please refer to the instruction
manual for further details.

On October 16, it displays the MessageBox:
Coded By: DarkChasm
CMD (C) DarkChasm

On december 21, it displays the MessageBox:
Christy
I LOVE CHRISTY

Macro.Word97.Colombia

Description Macro.Word97.Colombia

It is a dangerous stealth macro virus. It contains seven macros in one module "NewMacros": AutoOpen, AutoClose, AutoNew, AutoExec, kill, unprotect, engendrar.
It infects the global macros area on opening an infected document (AutoOpen) and infects other documents on opening, creating and closing (AutoOpen, AutoNew, AutoClose).
The virus turns off the Word virus protection (the VirusProtection option). It also disables the Tools/Macro, View/Toolbars menus (stealth).
On each infecting (on automacros executing) it tries to format floppy disk in the A: drive, prints to the status bar the text "Linea <Counter number> Esquema a" and increases its counter by one. If this counter exceed 99, the virus deletes all data on the C: drive by executing DOS command FORMAT.COM in hidden DOS window.
On closing each document the virus displays to the status bar:
Publicidad para Colombia!!

The virus also contains the strings:
COLOMBIA
*** Salvado por Colombia ***
Se salvã el Diskette

Home