MSN Spread virus BACKDOOR.WIN32.IRCBOT.ACD Removal method _ virus killing

Virus name: BACKDOOR.WIN32.IRCBOT.ACD (Kaspersky)
Virus size: 118,272 bytes
Adding shell way: Pe_patch NTKRNL
Sample Md5:71b015411d27794c3e900707ef21e6e7
Sample sha1:934b80b2bfbb744933ad9de35bc2b588c852d08e
Discovery Time: 2007.7
Update Time: 2007.7
Communication mode: Spread by MSN


Technical analysis


The virus sends messages to MSN contacts and a poisoned package that is disguised as a photo, and the system is infected when the other contact receives and opens the virus file in the compressed package.

Virus sent to the MSN Contact's virus compression package file name is not fixed, sent a message in Hanyu Pinyin.

After the virus is run in the system directory%windows% to generate a zip compressed file containing its own copy, file name is not fixed, by the following words alphanumeric random numbers:


Code:
Images
Photos2007_
Album
Photo
Photo_album
Image0



For example:

Photos2007_79.zip (PHOTOS2007_79.SCR)
Photo12.zip (PHOTO12.SCR)

To create a virus copy:
%system%\msn.exe

To release the DLL injection process:
%system%\notice.dll

To create a Shellserviceobjectdelayload startup method:


　　
Code:
[Hkey_local_machine\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"Modems" = "{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}"

[Hkey_classes_root\clsid\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}\inprocserver32]
@= "Notice.dll"

Note: {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} is a string of CLSID, which is not fixed by the virus, such as: {8ea5a050-8f75-4443-9830-9949156e066f}


The virus sends the corresponding text message to the MSN contact according to the language of the infected system, and sends the poison ZIP compress package:



Quote:
Hey, look at me and my pet. :p
Looking for hot summer pictures? So here they are!! (h)
Look in me and my volleyball team, working we asses offff (h)
Hey, look at me and my pet. :p
Psssssst ... just between me and you, please accept: $
This is me totaly naked:o please dont send to anyone else

Bak sana Paris Hilton ne Hale gelmis hapiste:(
Sen ve Ben!!! .... BAK:p
Baksana Benim Fotograflara Hihi:p
Hey benim fotolarimi Kabul et:o!!
Iyi Arkadasimla Fotorafdayim: $!!
Benim bu ciplak fotoda:o ama baskasina yollama

Regarde les tof de mes vacances en Tunisie loool
Toi et moi!!! ..... regarde:p
Hey stp regarde mes tof!
Hey s ' Il te plait accepte mes photos:o!!
Une tof de moi et ...: $!!

Kijk hoe erg Paris Hilton er aan toe is na gevangenschap:(
Jij en Ik!!!! ..... Kijk:p
Kijk eens naar mijn fotos hihi:p
HEY!! Accepteer mn fotos Dan!
Met Mijn beste vriend op de foto!! :$
Dit ben ik naakt op de foto, stuur alsjeblieft niet door.

Guck wie scheisse Paris Hilton aussieht, seitdem Sie wieder aus dem Knast ist:(
Du und ich!!! ..... guck:p
Siehe meine Fotos Hihi:p
Hey bitte nimm meine fotos an:o!!
Ein Foto mit meinem besten Freund und Mir: $!!
Das bin ich total nackt:o bitte sende es niemand anderem

Guarda come Paris Hilton sprecato? Dopo che era imprijonata:(
Tu ED IO!!! ..... Guarda:p
Guardi le mie foto hihi:p
Mairee photos Accept Karo:o!!
Una foto con me ed il mio amico migliore: $!!
Questa e me totaly nudo:o prego non trasmette a chiunque

Veja como Paris Hilton est?acabada depois de ter sido Presa:(
Voc?e EU!!!! .... Veja:p
Veja as Minhas fotos hehehe:p
Por favor Aceite as Minhas Fotos:o!!
Uma foto com o meu melhor amigo e EU: $!!
Esta sou eu totalmente nua:o por favor n 鉶 mande isso pra Ningu 閙

KAN BA LI XI ER DUN JIN jianyu HOU SHI DUO ME Qiaocui:(
NI He WO!!! .... QING KAN:p
KAN WO DE Zhaopian:p
Jieshou WO DE ZHAO pian:o!!
Yi ZHANG wo GEN wo pengyou ZUI HAO DE Zhaopian: $!!
ZHE SHI WO DE luozhao:o QING BU YAO FA GEI bieren!!

Kolla Hur F 鰎 St 鰎 D Paris Hilton 鋜, efter att hon f faulty gslades:(
Du och jag!! .... Kolla;)
Kolla p?min Bilder, Hihi:p
Hey, Acceptera Mina bilder, SN 鋖 la:o
En Bild p?mig och min b 鋝 ta v faulty: $!!!
Detta 鋜 jag helt naken. : o Skicka inte till n 錱 on Annan, SN 鋖 la ...

Mira c 髆 o Paris Hilton es perdida despu 閟 de ser Encarcelada:(
Usted e yo!!! .... Mira:p
Mira mis Fotos jejeje:p
Ha aceptado mis fotos por favor:o!!
Una foto con mi mejor amigo e yo: $!!
Esta soy yo totalmente desnuda:o por favor no env swing para-Nadie

Lede hvor spild Paris Hilton er efter hun fik f 鎛 Gsel:(
Jer og Mig!!! ... SE:p
Se p?min Fotos:p
Hej behage optage min foto:o!!
EN foto hos mig og min bedst ven: $!!
Denne er mig hele bar behage vage vendlig og sende den ikk til nogle:o



Trying to connect to a remote IRC:john.free4people.net


Cleanup steps
==========

1. Remove virus start Mode (Start menu-run-enter "regedit" into the registry in order to find the description option and follow the prompts):


　　
Code:
[Hkey_local_machine\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"Modems" = "{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}"


and the corresponding:


　　
Code:
[Hkey_classes_root\clsid\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}\inprocserver32]
@= "Notice.dll"


2. Restart your computer

3. Delete Files
%system%\msn.exe
%system%\notice.dll
%userprofile%\new.txt
%userprofile%\{6 bit random Letter}.exe
and the%windows% directory file name consists of the following characters and random numbers, file size of about 116KB virus compression package file:


　　
Code:
Images
Photos2007_
Album
Photo
Photo_album
Image0

For example:


Photos2007_79.zip (PHOTOS2007_79.SCR)
Photo12.zip (PHOTO12.SCR)