Skip to content
1-888-762-8736(M-F 8:00am-5:00pm CST)
1-877-218-7353(M-F 8:00am-5:00pm CST)
href="http://www.trendmicro.com/us/enterprise/index.html" id="ENT-overview-test2" title="SEE ALL ENTERPRISE SOLUTIONS">Enterprise Overview
This backdoor's logging and listening routines and alleged connection to a government agency are the subject of media interest in Germany.
To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.
This backdoor logs keystrokes when using certain Internet Browsers. It is capable of listening to and recording conversations from certain applications. It also gathers certain information.
It attempts to connect a remote IP address. It receives commands from a remote user and performs certain actions.
This backdoor may be dropped by other malware.
This backdoor is injected into the following processes running in memory:
It logs keystrokes when using the following Internet browsers:
It is capable of listening to conversations from the following applications:
It is capable of recording conversations on the application Skype.
It gathers the following information from certain applications:
It attempts to connect to the following remote IP address:
It receives commands from a remote user. It is capable of performing the following:
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Scan your computer with your Trend Micro product and note files detected as BKDR_R2D2.A
Restart in Safe Mode
To restart in Safe Mode:
• For Windows 2000 users
• For Windows XP users
• For Windows Server 2003 users
Search and delete the file detected as BKDR_R2D2.A
To manually delete a malware/grayware file from the affected system:
Restart in normal mode and scan your computer with your Trend Micro product for files detected as BKDR_R2D2.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Connect with us on
| | | |