Tibick.F is a peer-to-peer (P2P) network application worm with IRC-command like backdoor/bot capabilities.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
The Tibick.F worm spreads via peer-to-peer (P2P) network applications.
Upon execution, it drops a file named "svcnet.exe" into the Windows system folder.
The dropped file is set to run during Windows startup with the following registry key:
Tibick.F adds itself to the list of Windows Firewall trusted applications.
It checks for Internet connectivity by creating a connection to
http://tbc3.hanged.tk
Tibick.F also acts as a backdoor or as a bot, and listens for IRC-commands from a remote attacker.
It spreads itself via the following P2P applications:
To spread itself, users of the P2P network must download the worm's file. An appealing file name encourages downloads.
The names used are:
Ask questions in our Community.
Check the user guide for instructions.
Chat with with or call an agent.
Submit a file or URL for analysis.