Backdoor.Beasty.G is a Trojan Horse that opens a listening port on your computer. This Trojan also uses web.icq.com to send a message to its creator's ICQ Unified Messaging Center, which includes the IP address of the infected computer.

Backdoor.Beasty.G is written in the Borland Delphi programming language.


Also Known As: Backdoor.BeastDoor.200.a [KAV], BackDoor-AMQ [McAfee]

Client:
registry keys added:
HKEY_CLASSES_ROOT\.bad
HKEY_CLASSES_ROOT\.bst
HKEY_CLASSES_ROOT\BeastFile
HKEY_CLASSES_ROOT\BeastFile\DefaultIcon
HKEY_CLASSES_ROOT\BeastFile\shell
HKEY_CLASSES_ROOT\BeastFile\shell\open
HKEY_CLASSES_ROOT\BeastFile\shell\open\command
HKEY_CLASSES_ROOT\BeastFile1
HKEY_CLASSES_ROOT\BeastFile1\DefaultIcon
HKEY_CLASSES_ROOT\BeastFile1\shell
HKEY_CLASSES_ROOT\BeastFile1\shell\open
HKEY_CLASSES_ROOT\BeastFile1\shell\open\command



Servers:
c:\WINDOWS\SVCHOST.EXE
c:\WINDOWS\COMMAND\msaria.com
c:\WINDOWS\SYSTEM\mspfgf.com

size: 52.224 bytes

port: 6666 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "COM Service"
HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{44CC0112-AB51-22EF-BA32-20AA12E6115C} "StubPath"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "COM Service"

added:
c:\WINDOWS\SYSTEM\qmqr.blf

HKEY_CURRENT_USER\Software\Microsoft\RAS Autodial\Control "LoginSessionDisable"

Thank  you so much!   Will scan to see if this is the issue (and look at my registry for these)... I appreciate your help!

Janet