Spybot.HS, a variant of Spybot, is a Trojan. Spybot.HS uses IRC networks to spread and has automatic updating capabilities. Spybot.HS steals certain information from an infected computer.
Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.
Find the latest advice in our Community Knowledge Base.
See the manual for your F-Secure product on the Help Center.
Submit a file or URL for further analysis.
Spybot.HS allows control of a victims' computer remotely by sending specific commands via IRC channels. This backdoor can also steal data, spread to the local network, and to computers vulnerable to exploits.
It drops the following file upon execution:
It will then pass the control over to the dropped file and delete itself after execution.
Spybot.HS also checks for the existence of the following mutex to ensure that there is only one instance of itself running in memory:
Spybot.HS adds these registry value launch points:
It also adds the following registry entry as part of its installation routine:
It also creates the following registry entry to allow itself to bypass the Windows Firewall:
Spybot.HS also connects to the following IRC server:
It then joins the following IRC channel:
Once connected, Spybot.HS awaits for commands from a remote user. It may perform the following backdoor operations:
This backdoor may spread through local networks by taking advantage of the following vulnerabilities:
Spybot.HS is packed with ASProtect 2.1 and ASPack 2.12