Backdoor:W32/IRCBot.GNS

Classification

Malware

Backdoor

W32

Backdoor.Win32.IRCBot.dig, Worm/IrcBot.96950 (Avira), Worm:Win32/Pushbot.EA (Microsoft)

Summary

Backdoor:W32/IRCBot.GNS is a backdoor trojan. Backdoors are programs that allow remote attackers access to the infected machine to compromise data and send additional commands.

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Backdoor:W32/IRCBot.GNS can arrive on a system by being dropped via other malware.

When executed it will create a copy of itself in the following location:

  • %windir%\mservice.exe

Note: %windir% is the Windows directory, usually C:\Windows\

It creates a registry launchpoint to start itselt on system startup.

The malware will attempt to establish a connection to the following IRC Server and join the channel #pBot:

  • http.xn--mg-kka.com:[REMOVED]/TCP

The presence of outbound network traffic to this address is a symptom of infection.

It creates this value:

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ MSN = C:\Windows\mservice.exe

It creates this file:

  • %windir%/mservice.exe

Actions that Backdoor:W32/IRCBot.GNS can be ordered to carry out include:

  • DDOS a specific IP
  • Download and execute arbitrary files
  • Spread via MSN or AIM protocols
  • Retrieve IE stored passwords on the infected system
  • Updates itself

Date Created: -

Date Last Modified: -