Poebot.F is a member of SdBot backdoor family. SdBot is a large family of IRC-based backdoors. This particular variant is quite powerful, it uses several different exploits to spread to vulberable computers and it can steal confidential data from an infected computer.
This utility provides the special disinfection utility to clean Nyxem.e infection from a computer. This disinfection utility is called F-Force and it can be downloaded from our web and ftp sites:
ftp://ftp.f-secure.com/anti-virus/tools/f-force.zip
https://www.f-secure.com/tools/f-force.zip
The utility is distributed only in a ZIP archive that contains the following files:
To unpack the archive please use the WinZip or similar archiver.
IMPORTANT!Please make sure that you read the End User License Terms document (Eult.rtf) and the Readme file (either Readme.txt or Readme.rtf) before using the F-Force utility!
The F-Force utility needs the archive with the latest updates in order to function properly. The archive's name is LATEST.ZIP and it should be downloaded and put into the same folder where the F-Force utility is located. This archive with the latest updates can be downloaded from these locations:
https://download.f-secure.com/latest/latest.zip
ftp://ftp.f-secure.com/anti-virus/updates/latest/latest.zip
Please note that the F-Force utility can disinfect only certain malicious programs. Besides the utility does not scan inside archives. So after cleaning a computer with the F-Force utility it is recommended to scan all hard drives with F-Secure Anti-Virus and the latest updates to make sure that no infected files remain there.
A trial version of F-Secure Anti-Virus and the latest updates can be downloaded from F-Secure's website:
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
The backdoor's file is a Windows PE executable about 63 kilobytes long, packed with a file compressor. Some of the backdoor's strings are encrypted with a simple algorithm. The encryption key is not stored in the body of the backdoor, it is generated during runtime.
After the backdoor's file is run, it copies itself to Windows System folder and creates a startup key value for its file in Windows Registry. The backdoor can copy itself with any of the following names:
The following startup keys may be created under the following Registry keys:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
Startup key values can be:
"Local Security Authority Service" = "%WinSysDir%\lssas.exe ""Local Security Authority Service" = "%WinSysDir%\Isass.exe""Client Server Runtime Process" = "%WinSysDir%\csrs.exe""Windows Logon Application" = "%WinSysDir%\logon.exe""Windows Logon Application" = "%WinSysDir%\winIogon.exe""Windows Explorer" = "%WinSysDir%\explorer.exe""Winamp Agent" = "%WinSysDir%\winamp.exe""Windows Network Firewall" = "%WinSysDir%\firewall.exe""Spooler SubSystem App" = "%WinSysDir%\spoolsvc.exe"Spooler SubSystem App" = "%WinSysDir%\spooIsv.exe""Application Layer Gateway Service" = "%WinSysDir%\algs.exe""Microsoft Internet Explorer" = "%WinSysDir%\iexplore.exe"
where %WinSysDir% represents Windows System folder. On Windows XP systems it is usually C:\Windows\System32\ folder.
After installation the backdoor connects to an IRC server and creates a bot in a specific channel. A hacker who is present in a channel can control the backdoor by sending specific commands to a bot. After installation the backdoor deletes the file that it was originally started from.
The backdoor has the following capabilities:
The following exploits are used by the backdoor to spread to vulnerable computers:
The following list is used to bruteforce network share passwords:
The backdoor has a stub for the Ring0 code. This code is not available in this backdoor variant, but might be added into one of the future variants.