SAdoor

Overview

Vendor Description

SAdoor is a non listening remote shell/execution server. The program listens for a set of predefined packets in order to establish a connection or run a command. There is a client available at http://cmn.listprojects.darklab.org, (UNIX version only, use 1.1 for this release) that makes the sending of the required packets and connection-establishing as transparant as possible. The client also has alot of other features, like listening/connect mode as well as dumping the required payload (append it to an image, and download the image to secretly pass the command on to SAdoor) which makes it possible to generate the required packets in real connections.

Alias

Backdoor.Sadoor,

Variants

SAdoor 1.1 ·

Origins

Author

Claes M. Nyberg

Others By This Author

SAdoor 1.1 ·

Email

cmn@darklab.org

URL

http://cmn.listprojects.darklab.org/

Programming Language

Date of Origin

Variants from April, 2001 to December, 2003

Detection and Removal

Manual Removal

Follow these steps to remove SAdoor from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

Stop Running Processes:

Kill these running processes with Task Manager:

Unregister DLLs:

Unregister these DLLs with Regsvr32, then reboot:

Remove Files:

Remove these files (if present) with Windows Explorer:

SATAN SATAN1.0 SATAN1.1.1 SATANBUG SATANExtensions SAdoor SAdoor1.1 SBot1.0 SBot1.2 SBot2.0