F-Secure
Tools
Backdoor:W32/IRCBot.GNS
Summary
Backdoor:W32/IRCBot.GNS is a backdoor trojan. Backdoors are programs that allow remote attackers access to the infected machine to compromise data and send additional commands.
Disinfection
Automatic Disinfection
Allow F-Secure Anti-Virus to disinfect the relevant files.
For more general information on disinfection, please see Removal Instructions.
Additional Details
Backdoor:W32/IRCBot.GNS can arrive on a system by being dropped via other malware.
When executed it will create a copy of itself in the following location:
- %windir%\mservice.exe
Note: %windir% is the Windows directory, usually C:\Windows\
It creates a registry launchpoint to start itselt on system startup.
The malware will attempt to establish a connection to the following IRC Server and join the channel #pBot:
- http.xn--mg-kka.com:[REMOVED]/TCP
The presence of outbound network traffic to this address is a symptom of infection.
It creates this value:
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
MSN = C:\Windows\mservice.exe
It creates this file:
- %windir%/mservice.exe
Actions that Backdoor:W32/IRCBot.GNS can be ordered to carry out include:
- DDOS a specific IP
- Download and execute arbitrary files
- Spread via MSN or AIM protocols
- Retrieve IE stored passwords on the infected system
- Updates itself