Backdoor:W32/IRCBot.GNS

Threat description

Details

CATEGORYMalware
TYPEBackdoor

Summary

Backdoor:W32/IRCBot.GNS is a backdoor trojan. Backdoors are programs that allow remote attackers access to the infected machine to compromise data and send additional commands.



Removal

Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

Backdoor:W32/IRCBot.GNS can arrive on a system by being dropped via other malware.

When executed it will create a copy of itself in the following location:

  • %windir%\mservice.exe

Note: %windir% is the Windows directory, usually C:\Windows\

It creates a registry launchpoint to start itselt on system startup.

The malware will attempt to establish a connection to the following IRC Server and join the channel #pBot:

  • http.xn--mg-kka.com:[REMOVED]/TCP

The presence of outbound network traffic to this address is a symptom of infection.

It creates this value:

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ MSN = C:\Windows\mservice.exe

It creates this file:

  • %windir%/mservice.exe

Actions that Backdoor:W32/IRCBot.GNS can be ordered to carry out include:

  • DDOS a specific IP
  • Download and execute arbitrary files
  • Spread via MSN or AIM protocols
  • Retrieve IE stored passwords on the infected system
  • Updates itself

Submit a Sample

Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info