[Home] [History] [Msg Board] [Photo Album] [Irc-Help] [Tips] [Internet Survival]    
[FFALP] [Rules] [Info] [Mp3] [Links] [Downloads] [Guestbook] [Contact] [About]

Welcome to the #DalFriends Web Site!

Deep Throat (aka Win32.DeepThroat)

Deep Throat is a hacker's remote administration tool, much like the infamous Back Orifice and NetBus tools. Deep Throat allows a hacker to access data and gain control over some Windows functions on remote system. Deep Throat tool has client and server parts. The server part is installed on a remote system to be accessed. The server part can be dropped to a TEMP directory with a random name by a special dropper. On execution the server part installs itself to Windows directory and it will be executed automatically during next Windows startup.

The execution command for the server part is written to the registry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

If Deep Throat server part is released by a dropper it is the dropper that modifies the registry. The server part hides its process name in Windows task manager. Access to the running server part file is denied by Windows so it can't be removed easily while Windows is running. The client part allows to control the remote computer system where the server part is installed and active. The client part has a dialog interface which allows to perform tricks on remote system and to receive/send data, text and other information (some features are not implemented in version 1.0).

The client and server parts use TCP/IP protocol to communicate with each other. The client part has an option to scan a range of IP addresses to search for active server part and connect to it.

Below is the list of Deep Throat features:

1. Open and close CD-ROM tray
2. Show a message box on remote system with optional text
3. Hide or show Windows taskbar
4. Start FTP server on port 21 - upload/download files (not implemented in v1.0)
5. Capture screen to JPEG image and receive it from remote system
6. Open optional URLs with browsers on remote system
7. Turn monitor on/off - send powersave mode commands
8. Steal passwords (not implemented in v1.0)
9. Run any program on target system
10. Run any program on target system in invisible mode
11. Reboot Windows
12. Port scanner - to scan for computers with DT server running
13. Ping remote system - to check if there's a running DT server
14. Get remote system info

The server and client parts of Deep Throat are packed with NeoLite Windows EXE files compressor that decreases their size considerably and also makes detection of this Trojan more difficult.

The client part tries to install two TTF fonts on startup, but if Windows is installed to directory other than C:\WINDOWS\ the fonts are not installed and the main dialog window looks crappy.

Version 1.0 of Deep Throat has bugs that might crash Windows.