Backdoor:W32/IRCBot.GNS is a backdoor trojan. Backdoors are programs that allow remote attackers access to the infected machine to compromise data and send additional commands.
Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.
Backdoor:W32/IRCBot.GNS can arrive on a system by being dropped via other malware.
When executed it will create a copy of itself in the following location:
Note: %windir% is the Windows directory, usually C:\Windows\
It creates a registry launchpoint to start itselt on system startup.
The malware will attempt to establish a connection to the following IRC Server and join the channel #pBot:
The presence of outbound network traffic to this address is a symptom of infection.
It creates this value:
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ MSN = C:\Windows\mservice.exe
It creates this file:
Actions that Backdoor:W32/IRCBot.GNS can be ordered to carry out include:
- DDOS a specific IP
- Download and execute arbitrary files
- Spread via MSN or AIM protocols
- Retrieve IE stored passwords on the infected system
- Updates itself