Backdoor:W32/IRCBot.GNS is a backdoor trojan. Backdoors are programs that allow remote attackers access to the infected machine to compromise data and send additional commands.
Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.
More scanning & removal options
More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.
You may also refer to the Knowledge Base on the F-Secure Community site for more information.
Backdoor:W32/IRCBot.GNS can arrive on a system by being dropped via other malware.
When executed it will create a copy of itself in the following location:
Note: %windir% is the Windows directory, usually C:\Windows\
It creates a registry launchpoint to start itselt on system startup.
The malware will attempt to establish a connection to the following IRC Server and join the channel #pBot:
The presence of outbound network traffic to this address is a symptom of infection.
It creates this value:
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ MSN = C:\Windows\mservice.exe
It creates this file:
Actions that Backdoor:W32/IRCBot.GNS can be ordered to carry out include:
- DDOS a specific IP
- Download and execute arbitrary files
- Spread via MSN or AIM protocols
- Retrieve IE stored passwords on the infected system
- Updates itself