Spybot.HS, a variant of Spybot, is a Trojan. Spybot.HS uses IRC networks to spread and has automatic updating capabilities. Spybot.HS steals certain information from an infected computer.
Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.
More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.
You may also refer to the Knowledge Base on the F-Secure Community site for more information.
Spybot.HS allows control of a victims' computer remotely by sending specific commands via IRC channels. This backdoor can also steal data, spread to the local network, and to computers vulnerable to exploits.
It drops the following file upon execution:
It will then pass the control over to the dropped file and delete itself after execution.
Spybot.HS also checks for the existence of the following mutex to ensure that there is only one instance of itself running in memory:
Spybot.HS adds these registry value launch points:
It also adds the following registry entry as part of its installation routine:
It also creates the following registry entry to allow itself to bypass the Windows Firewall:
Spybot.HS also connects to the following IRC server:
It then joins the following IRC channel:
Once connected, Spybot.HS awaits for commands from a remote user. It may perform the following backdoor operations:
This backdoor may spread through local networks by taking advantage of the following vulnerabilities:
Spybot.HS is packed with ASProtect 2.1 and ASPack 2.12