W32.IRCBot.B

Risk Level 2: Low

Printer Friendly Page

Discovered: October 7, 2003

Updated: October 22, 2008 7:06:58 PM

Also Known As: Win32.SdBot.18976 [Computer Associates], W32/Sdbot.18976 [McAfee], Troj/IRCBot-P [Sophos], Troj/Ircbot-M [Sophos], IRCBot.D [Panda Software], Bck/IRCBot.D [Panda Software]

Type: Trojan, Worm

Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows NT, Windows 2000

W32.IRCBot.B is a back door Trojan horse that connects to an IRC server and awaits commands from a remote attacker, including spreading through network shares, spam email messages, IRC channels and to other computers. This Trojan is a variant of W32.IRCBot and W32.IRCBot.Gen.

Protection

Initial Rapid Release version October 7, 2003
Latest Rapid Release version July 19, 2008 revision 019
Initial Daily Certified version October 7, 2003
Latest Daily Certified version January 20, 2009 revision 048
Initial Weekly Certified release date October 8, 2003

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

Wild Level: Low
Number of Infections: 0 - 49
Number of Sites: 0 - 2
Geographical Distribution: Low
Threat Containment: Easy
Removal: Easy

Damage

Damage Level: Medium
Payload: Opens a back door.

Distribution

Distribution Level: Medium
Subject of Email: Last Update.
Name of Attachment: nav32.zip
Ports: TCP port 31337
Shared Drives: May copy itself to shared folders.

Writeup By: Neal Hindocha

Technical Details

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}