# MA-012.081999: MyCERT Advisory - Back Orifice 2000 (BO2K)

**Date:** 13 Aug 1999  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-012.081999  
**Advisory ID:** MA-012.081999

---

1.0 Description
#### 1.1 Overview
Back Orifice 2000, also known as BO2K, is a new version of BackOrifice. When installed on a Microsoft Windows system, this program allows others to gain full access to the system through a network connection. Though it is claimed to be a powerful administration tool for Microsoft Windows network administrators by the authors of BO2K, a group called Cult Of The Dead Cow, Back Orifice nevertheless was introduced as a dangerous backdoor trojan program. BO2K is capable of remotely control file system, registry, passwords, prosesses and system configuration of a Windows-based computer where it is installed.
BO2k was released on July 10, 1999 and it is capable of running under Windows NT, a feature which was absent from Back Orifice. It consists of two pieces: a server and a client application. The client application, running on one machine, may be used to monitor and control a second machine running the server application.
#### 1.2 Limitation
1.2.1 It runs under Windows 95/98/NT.
1.2.2 The port number through which the client controls the server is configurable. The Networking protocol could be TCP or UDP using any port number between 1 and 65535. For TCP, the default port is 54320 and for UDP, it is 54321.
### 2.0 Technical Matters
#### 2.1 Installation and Functionality
**2.1.1 Networking**
The Networking protocol could be TCP or UDP. The server application could use any port number between 1 and 65535. For TCP, the default port is 54320 and for UDP, it is 54321. The client application uses random port number.
**2.1.2 Encryption**
Information transmitted between a client application and a server application may be encrypted. Default encryption for BO2K International version is XOR, and 3DES for US version. Other encryption methods available as plug-ins are IDEA and CAST.
**2.1.3 File System Modification**
When installed the server executable (by default is BO2K.EXE) will move itself into:
Windows NT: C:\WINNT\SYSTEM32
Windows 95/98: C:\WINDOWS\SYSTEM
And renames itself as UMGR32.EXE. It then may delete its original copy.
**2.1.4 Registry Modification2.1.4.1 Windows NT**
In the Windows NT Registry, BO2K when installed modified two following locations. First, BO2K modified the Registry by adding these entries:
- HKLM\SYSTEM\CurrentControlSet\Services\Remote Administration Service
- "Type" = 00000110
"Start" = 00000002
"ErrorControl" = 00000000
"ImagePath" = "C:\WINNT\System32\UMGR32.EXE"
"DisplayName" = "Remote Administration Service"
"ObjectName" = "LocalSystem"
- HKLM\SYSTEM\CurrentControlSet\Services\Remote Administration Service\Security
- "Security" = (a long string of hex digits)
- HLKM\SYSTEM\CurrentControlSet\Services\Remote Administration Service\Enum
- "0" = "Root\LEGACY\_REMOTE ADMINISTRATION SERVICE\0000"
"Count" = 00000001
"NextInstance" = 00000001
- HKLM\SYSTEM\ControlSet001\Services\Remote Administration Service
- "Type" = 00000110
"Start" = 00000002
"ErrorControl" = 00000000
"ImagePath" = "C:\WINNT\System32\UMGR32.EXE"
"DisplayName" = "Remote Administration Service"
"ObjectName" = "LocalSystem"
- HKLM\SYSTEM\ControlSet001\Services\Remote Administration Service\Security
- "Security" = (a long string of hex digits)
- HLKM\SYSTEM\ControlSet001\Services\Remote Administration Service\Enum
- "0" = "Root\LEGACY\_REMOTE ADMINISTRATION SERVICE\0000"
"Count" = 00000001
"NextInstance" = 00000001
After the next reboot, BO2K modified the following Registry key:
- HKLM\SYSTEM\ControlSet003\Services\Remote Administration Service
- "Type" = 00000110
"Start" = 00000002
"ErrorControl" = 00000000
"ImagePath" = "C:\WINNT\System32\UMGR32.EXE"
"DisplayName" = "Remote Administration Service"
"ObjectName" = "LocalSystem"
- HKLM\SYSTEM\ControlSet001\Services\Remote Administration Service\Security
- "Security" = (a long string of hex digit
NOTE: HLKM = HKEY\_LOCAL\_MACHINE
**2.1.4.2 Windows 95/98**
In Windows 95/98, BO2K change the following Registry key:
- HLKM\Software\Microsoft\Windows\CurrentVersion\RunServices
The default key name is UMGR32, but it can be any name. The default data value is
"C:\WINDOWS\SYSTEM\UMGR32.EXE".
NOTE: HLKM = HKEY\_LOCAL\_MACHINE
### 3.0 Possible Steps
#### 3.1 Prevention
3.1.1 It is important to practice safe computing practices and avoid running any application that you don't know that may contains virus, trojans and other malicious programs.
3.1.2 Install and use antivirus products that can detect and disable this trojan.
3.1.3 Install and use intrusion detection system (IDS) that can detect attack signature of BO2K.
#### 3.2 Detection
As of today, the following sites offer utilities to detect BO2K. However do also visit your anti-virus vendor to check on how to detect BO2K.
**McAfee and Dr. Solomon**
http://vil.mcafee.com/dispVirus.asp?virus\_k=10229
**Norton AntiVirus**
http://www.symantec.com/avcenter/venc/data/back.orifice.2000.trojan.html
**F-Secure AntiVirus**
http://www.europe.f-secure.com/v-descs/backori.shtml
**Sophos AntiVirus**
http://www.sophos.com/virusinfo/analyses/bo2k.html
For other products, please refer to our web site below for the list of known antivirus sites:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=b83f4c4d-f1e2-4a9d-ab55-6389ae1f6efc
)
We also recommend you to use intrusion detection system (IDS) tools. Some IDS have capability to detect BO2K attack signature.
#### 3.3 Removal
**3.3.1 Windows NT**
Edit the registry using Windows' REGEDIT.EXE and delete the following key:
HKLM\SYSTEM\CurrentControlSet\Services\Remote Administration Service
This action will also delete modification made by BO2K in
HLKM\SYSTEM\ControlSet001\Services
and in other
ControlSet Registry keys (ie., ControlSet002, ControlSet003, etc).
Reboot the machine, and delete the server application file (by default is UMGR32.EXE) located in
C:\WINNT\SYSTEM32\ directory.
**3.3.2 Windows 95/98**
Open the Registry using any registry editor and go to the following location:
HLKM\Software\Microsoft\Windows\CurrentVersion\RunServices
and delete the value that contains the name of the file detected as BO2K. Reboot the machine and delete the server application file (by default is UMGR32.EXE) located in
C:\WINDOWS\SYSTEM\ directory.
### 4.0 More Information
To obtain more information on this virus, please refer to the following site :
**Avert Research Center**
http://vil.mcafee.com/dispVirus.asp?virus\_k=10229
**Symantec AntiVirus Reseacrh Center**
http://www.symantec.com/avcenter/venc/data/back.orifice.2000.trojan.html
**Data Fellows Computer Virus Information Pages**
http://www.europe.f-secure.com/v-descs/backori.shtml