Alias: Proxy-FBSR (McAfee),
TrojanProxy.Win32.Frank (Kaspersky),
Win32/FBSR.Trojan,
Win32/SdBot.KU (Eset)
Category: Win32
Type: Trojan
Published Date: 2/8/2004
Last Modified: 2/8/2004
CHARACTERISTICS
Win32.Ranck.K is a trojan that opens a SOCKS proxy on an affected machine. It is 45,056-bytes in size.
Method of Installation
When executed, the trojan modifies the registry to ensure that the copy of itself on the affected machine is run at each Windows start:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinManage= <original execution location>
Payload
Opens SOCKS Proxy
The trojan opens a SOCKS proxy on the affected machine using port 35541. SOCKS proxy servers are widespread, and used legitimately for improving system performance, caching web pages and filtering client requests. Unfortunately, SOCKS proxy servers can also be used for undermining system security; attackers can hide their IP address by "bouncing" their requests off a victim?s computer with an open SOCKS proxy.
Analysis by Matthew McCormack
http://www3.ca.com/virusinfo/virus.aspx?ID=38227

Chowhound
Comic Vine
GameFAQs
GameSpot
Giant Bomb
TechRepublic