Backdoor.IRC.Flood

· Overview ·
· Origins ·
· Operation ·
· Detection and Removal ·
· Research ·

Overview

Alias:

 Backdoor/IRCFlood.C [Computer Associates], IRC.Flood [Computer Associates], IRC.Flood.C [Computer Associates], mIRC/Flood.D [Computer Associates], Trojan Horse [Panda], Worm Generic.LC [Panda]

Category:

Flooder: A program that overloads a connection by any mechanism, such as fast pinging, causing a DoS attack.

Backdoor: A secret or undocumented means of getting into a computer system, or software that uses such a means to penetrate a system. Some software has a backdoor placed by the programmer to allow them to gain access to troubleshoot or change the program. Software that is classified as a "backdoor" is designed to exploit a vulnerability in a system, and open it to future access by an attacker.

IRC War: Any tool that uses Internet Relay Chat for spoofing, eavesdropping, sniffing, spamming, breaking passwords, harassment, fraud, forgery, 'imposturing', electronic trespassing, tampering, hacking, nuking, system contamination including without limitation use of viruses, worms and Trojan horses causing unauthorized, damaging or harmful access and/or retrieval of information and data on your computer and other forms of activity that may even be considered unlawful.

Trojan: Any program with a hidden intent. Trojans are one of the leading causes of breaking into machines. If you pull down a program from a chat room, new group, or even from unsolicited e-mail, then the program is likely trojaned with some subversive purpose. The word Trojan can be used as a verb: To trojan a program is to add subversive functionality to an existing program. For example, a trojaned login program might be programmed to accept a certain password for any user's account that the hacker can use to log back into the system at any time. Rootkits often contain a suite of such trojaned programs.

Worm: A program that propagates itself by attacking other machines and copying itself to them. Both worms and viruses are self-replicating code that travels from machine to machine by various means. Both worms and viruses have, as their first objective, merely propagation. Both can be destructive, depending on what payload, if any, they have been given. But there are some differences: worms may replace files, but do not insert themselves into files. In contrast, viruses insert themselves in files, but do not replace them.

Variants:
  • Backdoor.IRC.Flood.f
  • Backdoor.IRC.Flood.t
  • Backdoor.IRC.Flood.v
    		•

    Similar Pests:

    		 Flooder · Backdoor · IRC War · Trojan · Worm

    Origins

    Date of Origin:

    		 Variants from May, 2002 to April, 2004

    Operation

    Storage Required:
  • Backdoor.IRC.Flood: at least 77 KB
  • Backdoor.IRC.Flood.f: at least 33 KB
  • Backdoor.IRC.Flood.t: at least 169 KB
  • Backdoor.IRC.Flood.v: at least 49 KB
    		•

    Detection and Removal

    Automatic Removal:

    PestPatrol detects this.

    PestPatrol removes this.

    Manual Removal:

    		 Follow these steps to remove Backdoor.IRC.Flood from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.
    Stop Running Processes:

    Kill these running processes with Task Manager:

    Remove Files:

    Remove these files (if present) with Windows Explorer:

    Research

    File Analyses:

    More Info:
  • AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
    		•

    Research By:
  • PestPatrol's Pest Research Center
    		•

    Last Revised:

    		 March 22, 2005