9/23: Backdoor-CHP Lets Data Through
September 23, 2004

Backdoor-CHP is a remote access Trojan that allows remote attackers to relay data (such as SPAM) through the compromised system. When run, the Trojan copies itself to the WINDOW SYSTEM directory as w32.exe and creates registry run keys as well as a service to load itself at system startup:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ Run "w32" = w32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ Run "w32" = w32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ RunServices "w32" = w32.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32 "DisplayName" = Windows Service Application
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32 "ImagePath" = C:\WINDOWS\System32\w32.exe

The Trojan runs a proxy server on TCP ports 9687, and a random TCP port. Notification is sent to the Trojan author via a page on the www.earthlabs.biz web site.

Find out more at McAfee page.