Backdoor.Graybird.E

Backdoor.Graybird.E is a variant of Backdoor.Graybird. This Trojan Horse gives its creator unauthorized access to your computer. The existence of the file, Sp00lsv.exe, is an indication of a possible infection.

This threat is written in Borland Delphi and is compressed with ASPack.



This Trojan Horse was spammed in an email, claiming to be from Microsoft.

The email had the following characteristics:

Subject: updated
Message:
Dear customer:
At 11:34 A.M. Pacific Time on August 13, Microsoft began investigating a
worm reported by Microsoft Product Support Services (PSS). A new worm
commonly known as W32.Blaster.Worm has been identified that exploits the
vulnerability that was addressed by Microsoft Security Bulletin MS03-026.

Download the attached update program. To begin the download process, do one
of the following:

To download the attached program to your computer for installation at a
later time, click Save or Save this program to disk.then run it.
If you have any problem ,connect to us immediately.

Attachment: 03-26updated.exe

Protection

• Initial Rapid Release version August 14, 2003
• Latest Rapid Release version August 20, 2008 revision 017
• Initial Daily Certified version August 14, 2003
• Latest Daily Certified version August 20, 2008 revision 016
• Initial Weekly Certified release date August 20, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Low