Encyclopedia entry
Updated:
Apr 17, 2011
| Published:
Oct 02, 2008
Aliases
Backdoor.Win32.Bifrose.phc
(Kaspersky)
-
Troj/Bifrose-UV
(Sophos)
-
Backdoor.Bifrose.ZTO
(BitDefender)
-
BackDoor-CEP
(McAfee)
-
Backdoor.Bifrose
(Symantec)
Alert Level
(?)
Severe
Antimalware protection details
Microsoft recommends that you download the
latest definitions
to get protected.
Detection last updated:
Definition: 1.151.922.0
Released: May 25, 2013
|
|
Detection initially created:
Definition: 1.45.287.0
Released: Oct 07, 2008
|
Summary
Backdoor:Win32/Bifrose is a backdoor trojan that connects to a remote IP address using either TCP port 81 or a random port. It allows an attacker to access the computer and perform various actions.
Symptoms
There are no common symptoms associated with this threat. Alert notifications from installed antivirus software may be the only symptom(s).
Technical Information (Analysis)
Backdoor:Win32/Bifrose is a backdoor trojan that connects to a remote IP address using either TCP port 81 or a random port. It allows an attacker to access the computer.
The Bifrose trojan family is highly configurable. Thus, the locations of their installed files on an infected computer and the TCP ports they use to connect may vary. They allow an attacker to perform any of the following actions on the affected machine:
- Manage running processes
- Manipulate files or registry data
- Obtain installed program details
- Log keystrokes
- Screen capturing
- System shutdown or reboot
- Command shell
Analysis by Francis Allan Tan Seng
Prevention
Recovery
To detect and remove this threat and other malicious software that may be installed in your computer, run a full-system scan with an up-to-date antivirus product such as the following:
