BD Dark Connection 1.2

Description

This signature detects Backdoor Dark connection 1.2 activity.

Additional Information

Backdoor Dark connection 1.2 is a Trojan that opens up a backdoor program that, once installed on a system, permits unauthorized users to remotely control network traffic, stop critical messages from being displayed, manipulate user accounts, etc. Dark Connection runs from the server files "C:\WINDOWS\SYSTEM\MSGSRV16.EXE" and "C:\WINDOWS\SYSTEM\DIRECTX3D.EXE", typically operating over port 666 via TCP.

Aliases: Backdoor.DCI

Affected

• Microsoft Windows 2000 Advanced Server SP1, SP2, SP3, SP4
• Microsoft Windows 2000 Datacenter Server SP1, SP2, SP3, SP4
• Microsoft Windows 2000 Professional SP1, SP2, SP3, SP4
• Microsoft Windows 2000 Resource Kit
• Microsoft Windows 2000 Server SP1, SP2, SP3, SP4
• Microsoft Windows 2000 Server Japanese Edition
• Microsoft Windows 2000 Terminal Services SP1, SP2, SP3, SP4
• Microsoft Windows 2000 Workstation rev.2031, rev.2072, rev.2195, SP1, SP2, SP3
• Microsoft Windows 95 Build 490.R6, j, SP1, SR2
• Microsoft Windows 98 a, b, j, SP1
• Microsoft Windows 98 With Plus! Pack
• Microsoft Windows 98SE
• Microsoft Windows CE 2.0, 3.0, 4.2
• Microsoft Windows ME
• Microsoft Windows Server 2003 Datacenter Edition SP1, SP1 Beta 1
• Microsoft Windows Server 2003 Datacenter Edition Itanium SP1, SP1 Beta 1
• Microsoft Windows Server 2003 Datacenter x64 Edition
• Microsoft Windows Server 2003 Enterprise Edition SP1, SP1 Beta 1
• Microsoft Windows Server 2003 Enterprise Edition Itanium SP1, SP1 Beta 1
• Microsoft Windows Server 2003 Enterprise x64 Edition
• Microsoft Windows Server 2003 Standard Edition SP1, SP1 Beta 1
• Microsoft Windows Server 2003 Standard x64 Edition
• Microsoft Windows Server 2003 Web Edition SP1, SP1 Beta 1
• Microsoft Windows Vista beta
• Microsoft Windows XP
• Microsoft Windows XP 64-bit Edition SP1
• Microsoft Windows XP 64-bit Edition Version 2003 SP1
• Microsoft Windows XP Embedded SP1
• Microsoft Windows XP Home SP1, SP2
• Microsoft Windows XP Media Center Edition SP1, SP2
• Microsoft Windows XP Professional SP1, SP2
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows XP Tablet PC Edition SP1, SP2

Response

There are several Backdoor detection programs on the market that are said to be able to scan for and detect a Backdoor Dark connection 1.2 server on your system. Some of the better known AntiVirus vendors have included detection strings in their virus definitions.

Additional References

• Pest Patrol Info - Dark Connection Inside