Name:

Backdoor.Bredolab.pek

Added:

October 17, 2011

Type:

Backdoor

Risk:

Low

Payload:

N/A

At risk systems:

Windows 95/98/ME/XP/NT/2003

Description:

When Backdoor.Bredolab.pek is executed, it performs the following activities:

After execution, it drops the following files:

%Windir%\system32\Packet.dll
%Windir%\system32\wpcap.dll
%Windir%\system32\drivers\npf.sys

It creates/modifies the following registry entries:

DisplayName: "WinPcap Packet Driver (NPF)"
ImagePath: "system32\drivers\NPF.sys"
HKLM\System\CurrentControlSet\Services\NPF