Backdoor.Win32.IRCBot.abc

The backdoor modifies system registry values to the values show below:

[HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters]
DisableRawSecurity = 1

The backdoor also terminstes the "sharedaccess" service.

It harvests passwords and information about Microsoft Outlook user accounts from the following registry key parameters:

[HKLM\Software\Microsoft\Internet Account Manager\Accounts]
SMTP Email Address
SMTP Server
SMTP Port
POP3 User Name
POP3 Server
POP3 Port
IMAP Port
IMAP Server
IMAP User Name
HTTPMail User Name
HTTPMail Server

It harvests passwords and information about Opera Mail user accounts from the configuration file:

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the backdoor process.
2. Delete the original backdoor file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following parameter from the system registry (see What is a system registry and how do I use it for details on how to edit the registry):

   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   "Wupdate" = " 
   
       
   
   This Trojan provides a remote malicious user with access to the victim machine.
   It is managed via IRC. It is a Windows PE EXE file. It is 32,704 bytes in size.
   Installation
   When installing, the backdoor creates a system process, svchost.exe, and injects
   its code into process memory. The backdoor code will:
   Copy the backdoor executable file to the Windows system directory
   The name that the backdoor will be saved under is created in the following way:
   a file is chosen at random from the system registry. A random lower case letter
   from the Latin alphabet is added to the end of the file name, as is an .exe
   extension.
   In order to ensure that the backdoor is launched automatically
   when the system is rebooted, it adds a link to its executable file to the system
   registry:
   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   "Wupdate" = "<ltpath to backdoor executable file>"
   
   Payload