Threat Description

Backdoor: W32/IRCBot.GNS

Details

Category: Malware
Type: Backdoor
Platform: W32
Aliases: Backdoor.Win32.IRCBot.dig, Worm/IrcBot.96950 (Avira), Worm:Win32/Pushbot.EA (Microsoft)

Summary


Backdoor:W32/IRCBot.GNS is a backdoor trojan. Backdoors are programs that allow remote attackers access to the infected machine to compromise data and send additional commands.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.



Technical Details


Backdoor:W32/IRCBot.GNS can arrive on a system by being dropped via other malware.

When executed it will create a copy of itself in the following location:

  • %windir%\mservice.exe

Note: %windir% is the Windows directory, usually C:\Windows\

It creates a registry launchpoint to start itselt on system startup.

The malware will attempt to establish a connection to the following IRC Server and join the channel #pBot:

  • http.xn--mg-kka.com:[REMOVED]/TCP

The presence of outbound network traffic to this address is a symptom of infection.

It creates this value:

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ MSN = C:\Windows\mservice.exe

It creates this file:

  • %windir%/mservice.exe

Actions that Backdoor:W32/IRCBot.GNS can be ordered to carry out include:

  • DDOS a specific IP
  • Download and execute arbitrary files
  • Spread via MSN or AIM protocols
  • Retrieve IE stored passwords on the infected system
  • Updates itself





SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More