Threat Description

Backdoor:​W32/IRCBot.GNS

Details

Aliases: Backdoor.Win32.IRCBot.dig, Worm/IrcBot.96950 (Avira), Worm:​Win32/Pushbot.EA (Microsoft)
Category: Malware
Type: Backdoor
Platform: W32

Summary



Backdoor:W32/IRCBot.GNS is a backdoor trojan. Backdoors are programs that allow remote attackers access to the infected machine to compromise data and send additional commands.



Removal



Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details



Backdoor:W32/IRCBot.GNS can arrive on a system by being dropped via other malware.

When executed it will create a copy of itself in the following location:

  • %windir%\mservice.exe

Note: %windir% is the Windows directory, usually C:\Windows\

It creates a registry launchpoint to start itselt on system startup.

The malware will attempt to establish a connection to the following IRC Server and join the channel #pBot:

  • http.xn--mg-kka.com:[REMOVED]/TCP

The presence of outbound network traffic to this address is a symptom of infection.

It creates this value:

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ MSN = C:\Windows\mservice.exe

It creates this file:

  • %windir%/mservice.exe

Actions that Backdoor:W32/IRCBot.GNS can be ordered to carry out include:

  • DDOS a specific IP
  • Download and execute arbitrary files
  • Spread via MSN or AIM protocols
  • Retrieve IE stored passwords on the infected system
  • Updates itself





SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Learn More