1.6 Typical Examples of Viruses and Trojans
65
Fig. 1.34 Back Orifice 2000 work window
are transmitted in encrypted form. Depending on the command, the Trojan performs
the following actions:
• Sends computer name, username, and information on the system: processor type,
memory size, system version, installed devices, etc.;
• Allows remote access to drives (share);
• Searches for files on drives;
• Sends/receives, deletes, copies, renames, executes any file;
• Creates/deletes a directory;
• Packs/unpacks files;
• Disconnects the current user from the network;
• Hangs the system;
• Sends a list of active processes;
• Uploads the specified process;
• Connects to network resources;
• Sends and receives cached passwords (used by the user in the current session),
searches a password for ScreenSaver (decrypts and sends it);
• Brings up a MessageBox;
• Reads/modifies the registry;
• Opens/redirects other TCP/IP sockets;