You might be noticing strange behavior on your PC. Lights flickering on your modem when you aren’t streaming. Programs launching on their own. Your mouse moving without you touching it. If you are running an older Windows system, you are likely dealing with a Back Orifice or Netbus infection.
These aren’t glitches. They are “Trojan horse” type programs.
Both Back Orifice (BO) and Netbus are Windows 95/98 applications. Their sole purpose? To let someone else access your machine over the Internet. Usually, that someone is up to no good.
How the Install Works (And Why You’re at Fault)
Here is the hard truth: you have to install the server side of the application yourself.
The malware does not spread like a traditional computer virus. It doesn’t jump from file to file automatically. You have to consciously or unconsciously run the executable (EXE) file.
Attackers get you to do this in two common ways:
1. They send the server EXE to you in an e-mail message.
2. They trick you into downloading an application that contains the trojan.
Once you click that file, the server is installed. It will start running automatically every time you turn on your computer. You have handed over the keys.
Once you execute the server EXE, the server is installed and will start running automatically every time you turn on your computer.
The Remote Control Nightmare
With the server sitting in your background, an attacker can run the BO client program. They can control your computer remotely.
What can they do?
– Run programs.
– Erase files.
– Access your data.
This is not a good thing.
Detection Is Possible
The good news? It is easy to detect Back Orifice. You can do it manually. You can also use software to find it. You are not helpless.
Learn More About This Threat
- How Computer Viruses Work
- How Web Servers Work
- Symantec: Information on Back Orifice and NetBus
- Trojan horses: Back Orifice & Netbus
- CNET News.com: Windows “back door” raises flags
