Threat Description

Backdoor:​W32/IRCBot.GNS

Details

Aliases:Backdoor.Win32.IRCBot.dig, Worm/IrcBot.96950 (Avira), Worm:​Win32/Pushbot.EA (Microsoft)
Category:Malware
Type:Backdoor
Platform:W32

Summary



Backdoor:W32/IRCBot.GNS is a backdoor trojan. Backdoors are programs that allow remote attackers access to the infected machine to compromise data and send additional commands.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.



Technical Details



Backdoor:W32/IRCBot.GNS can arrive on a system by being dropped via other malware.

When executed it will create a copy of itself in the following location:

  • %windir%\mservice.exe

Note: %windir% is the Windows directory, usually C:\Windows\

It creates a registry launchpoint to start itselt on system startup.

The malware will attempt to establish a connection to the following IRC Server and join the channel #pBot:

  • http.xn--mg-kka.com:[REMOVED]/TCP

The presence of outbound network traffic to this address is a symptom of infection.

It creates this value:

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ MSN = C:\Windows\mservice.exe

It creates this file:

  • %windir%/mservice.exe

Actions that Backdoor:W32/IRCBot.GNS can be ordered to carry out include:

  • DDOS a specific IP
  • Download and execute arbitrary files
  • Spread via MSN or AIM protocols
  • Retrieve IE stored passwords on the infected system
  • Updates itself





SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Learn More