Follow:

 

Backdoor:Win32/Bifrose


Backdoor:Win32/Bifrose is a backdoor trojan that connects to a remote IP address using either TCP port 81 or a random port. It allows an attacker to access the computer and perform various actions.


What to do now

Use the following free Microsoft software to detect and remove this threat:

You should also run a full scan. A full scan might find hidden malware.
Enable MAPS 

Enable the Microsoft Active Protection Service (MAPS) on your system to protect your enterprise software security infrastructure in the cloud.

  1. Check if MAPS is enabled in your Microsoft security product:

    1. Select Settings and then select MAPS.

    2. Select Advanced membership, then click Save changes. With the MAPS option enabled, your Microsoft anti-malware security product can take full advantage of Microsoft's cloud protection service

  2. Join the Microsoft Active Protection Service Community.
Get more help

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

 

Threat behavior

Backdoor:Win32/Bifrose is a backdoor trojan that connects to a remote IP address using either TCP port 81 or a random port. It allows an attacker to access the computer.
 
The Bifrose trojan family is highly configurable. Thus, the locations of their installed files on an infected computer and the TCP ports they use to connect may vary. They allow an attacker to perform any of the following actions on the affected machine:
 
  • Manage running processes
  • Manipulate files or registry data
  • Obtain installed program details
  • Log keystrokes
  • Screen capturing
  • System shutdown or reboot
  • Command shell
 
Analysis by Francis Allan Tan Seng

Symptoms

There are no common symptoms associated with this threat. Alert notifications from installed antivirus software may be the only symptom(s).

Prevention


Alert level: Severe
First detected by definition: 1.45.287.0
Latest detected by definition: 1.205.1115.0 and higher
First detected on: Oct 07, 2008
This entry was first published on: Oct 02, 2008
This entry was updated on: Jun 02, 2015

This threat is also detected as:
  • Backdoor.Win32.Bifrose.phc (Kaspersky)
  • Troj/Bifrose-UV (Sophos)
  • Backdoor.Bifrose.ZTO (BitDefender)
  • BackDoor-CEP (McAfee)
  • Backdoor.Bifrose (Symantec)