Backdoor.Win32.IRCBot (also known as W32/Poebot-JT, W32/Backdoor.NYG, Win32/IRCBot.TS, and W32/Gaobot.worm.gen.e[1]) is a backdoor computer worm that is spread through MSN Messenger and Windows Live Messenger by downloading photo album.zip from someone.[2] Once installed on a PC, the worm copies itself into a Windows system folder, creates a new file displayed as "Windows Genuine Advantage Validation Notification" and becomes part of the computer's automatic startup.[2] It provides a backdoor server and allows a remote intruder to gain access and control over the computer via an Internet Relay Chat channel.[1] This allows for confidential information to be transmitted to a hacker.[3]
References
- ^ a b Express Computer Online: Sophos reports W32/Poebot-JT Retrieved January 2, 2008
- ^ a b Seattle Times: Worm pretends it's Windows program Retrieved January 2, 2008
- ^ Net-Security: Search engine vulnerabilities a major factor in proliferation of malware infections Retrieved January 2, 2008