Hacktool.SkSocket

Updated:

February 13, 2007 11:34:16 AM

Type:

Hack Tool

Version:

v1.09

Publisher:

GNU China

Risk Impact:

High

File Names:

SkSockServer_enu.exe,WinTcpIp.exe

Systems Affected:

Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

Behavior

Hacktool.SkSocket runs silently, installing itself as a service under Windows NT/2000/XP, and provides a socks proxy service on port 1813 (default).

Symptoms

• The files on the system are detected as Hacktool.SkSocket.
• Numerous connections to/from port 1813.

Transmission

May be distributed with Trojan packages, or may arrive disguised as an IRC script.

Antivirus Protection Dates

• Initial Rapid Release version September 25, 2003
• Latest Rapid Release version September 25, 2003
• Initial Daily Certified version September 25, 2003
• Latest Daily Certified version December 18, 2007 revision 039
• Initial Weekly Certified release date October 1, 2003