A remote administration tool (RAT) which bypasses normal security mechanisms to secretly control a program, computer or network.
Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.
More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.
You may also refer to the Knowledge Base on the F-Secure Community site for more information.
This malware may arrive as a file downloaded from a malicious website, or as a message received over an instant messaging application such as MSN messenger, AIM, or AIM Triton.
Upon execution, the malware will drop a copy of itself into the Windows folder as:
It creates an entry in the registry, which allows the malware to start automatically:
It then checks the following processes:
The malware will search the process memory for the following strings:
It will terminate the processes in the process memory if found.
It then immediately attempts to connect to a specific channel on a specific IRC server, which the unauthorized remote user is using to access and control any infected machines.
Once connected to the IRC server, the infected machine is ready to accept and execute commands from the remote user. The remote user can perform a variety of actions such as:
Attempts to connect to: