Size:	335,872 bytes
Category:	Malware
Type:	Trojan, Backdoor
Date of Discovery:	January 09, 2007

Spybot.HS, a variant of Spybot, is a Trojan. Spybot.HS uses IRC networks to spread and has automatic updating capabilities. Spybot.HS steals certain information from an infected computer.

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Spybot.HS allows control of a victims' computer remotely by sending specific commands via IRC channels. This backdoor can also steal data, spread to the local network, and to computers vulnerable to exploits.

It drops the following file upon execution:

It will then pass the control over to the dropped file and delete itself after execution.

Spybot.HS also checks for the existence of the following mutex to ensure that there is only one instance of itself running in memory:

Spybot.HS adds these registry value launch points:

It also adds the following registry entry as part of its installation routine:

It also creates the following registry entry to allow itself to bypass the Windows Firewall:

Spybot.HS also connects to the following IRC server:

It then joins the following IRC channel:

Once connected, Spybot.HS awaits for commands from a remote user. It may perform the following backdoor operations:

This backdoor may spread through local networks by taking advantage of the following vulnerabilities:

Spybot.HS is packed with ASProtect 2.1 and ASPack 2.12