How to clear Backdoor. Win32.IRCBot. acd from MSN virus propagation

Virus name: Backdoor. Win32.IRCBot. acd (Kaspersky)
Virus size: 118,272 bytes
Shelling method: PE_Patch NTKrnl
Sample MD5: 71b015411d27794c3e900707ef21e6e7
Sample SHA1: 934b80b2bfbb744933ad9de35bc2b588c852d08e
Time detected: 2007.7
Time updated: 2007.7
Transmission Mode: Spread through MSN

Technical Analysis

The virus sends a message to the MSN contact and is a photo-infected compressed package. When the contact of the other party receives and opens the virus file in the compressed package, the system is infected.

The file name of the virus compressed package sent by the virus to the MSN contact is not fixed, and the sent message contains Chinese pinyin.

After the virus is run, the system directory % Windows % will generate a ZIP file containing its own copy. The file name is not fixed and consists of the following characters and random numbers:

Code:
Images
Photos2007 _
Album
Photo
Photo_album
Image0

For example:

Photos2007_79.zip (photos2007_79.scr)
Photo12.zip (photo12.scr)

Create a virus copy:
% System % \ msn.exe

Release dll injection process:
% System % \ notice. dll

Create ShellServiceObjectDelayLoad startup method:

　　
Code:
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ ShellServiceObjectDelayLoad]
"Modems" = "{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX }"

[HKEY_CLASSES_ROOT \ CLSID \ {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} \ InProcServer32]
@ = "Notice. dll"

Note: {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} is a string of CLSID, the CLSID generated by the virus is not fixed, for example: {8EA5A050-8F75-4443-9830-9949156E066F}

The virus sends the corresponding text message to the MSN contact based on the language of the infected system, and also sends the ZIP package containing the virus:

Quote:
Hey please look at me and my pet...: p
Looking for hot summer pictures? Well here they are !! (H)
Look at me and my volleyball team, working our asses offff (h)
Hey please look at me and my pet...: p
Psssssst... just between me and you, please accept: $
This is me totaly naked please dont send to anyone else

Bak sana Paris Hilton ne hale gelmis hapiste
Sen ve Ben !!! ... BAK: p
Baksana benim fotograflara hihi: p
Hey benim fotolarimi kabul et !!
Iyi arkadasimla fotorafdayim: $ !!
Benim bu cipaks fotoda ama baskasina yollama

Regarde les tof de mes vacances en tunisie loool
Toi et moi !!! ... Regarde: p
Hey stp regarde mes tof!
Hey s 'il te plait accepte mes photos !!
Une tof de moi et...: $ !!

Kijk hoe erg Paris Hilton er aan toe is na gevangenschap
Jij en Ik !!!! ... Kijk: p
Kijk eens naar mijn fotos hihi: p
HEY !! Accepteer mn fotos dan!
Met mijn beste vriend op de foto !! : $
Dit ben ik nab7-op de foto, stuur alsjeblieft niet door.

Guck wie scheisse Paris Hilton aussieht, seitdem sie wieder aus dem knast ist
Du und ich !!! ... Guck: p
Siehe meine fotos hihi: p
Hey bitte nimm meine fotos !!
Ein foto mit meinem besten freund mir: $ !!
Das bin ich total nackt bitte sende es niemand andreem

Guarda come Paris Hilton sprecato? Dopo che era imprijonata
Tu ed io !!! ... Guarda: p
Guardi le mie foto hihi: p
Mairee photos accept karo !!
Una foto con me ed il mio amico migliore: $ !!
Questa e me totaly nudo prego non trasmette a chiunque

Veja como Paris Hilton est? Acabada depois de ter sido presa
Voc? E eu !!!! ... Veja: p
Veja as minhas fotos hehehe: p
Por favor aceite as minhas fotos !!
Uma foto com o meu melhor amigo e eu: $ !!
Esta sou eu totalmente nua por favor n unknown mande isso upa ningu Region

KAN BA LI XI ER DUN JIN JIANYU HOU SHI DUO ME QIAOCUI
Ni he wo !!! ... Qing kan: p
Kan wo de zhaopian: p
Jieshou wo de zhao pian !!
Yi zhang wo gen wo pengyou zui hao de zhaopian: $ !!
Zhe shi wo de luozhao qing bu yao fa gei bieren !!

Kolla hur f branch st Branch d Paris Hilton branch, efter att hon f branch gslades
Du och jag !! ... Kolla
Kolla p? Min bilder, hihi: p
Hey, accepw.mina bilder, sn =la
En bild p? Mig och min B branch ta v branch: $ !!!
Detta encrypt jag HELT naken... Skicka inte till n records on annan, sn la...

Mira c branch o Paris Hilton es perdida despu sort de ser encarcelada
Usted e yo !!! ... Mira: p
Mira mis fotos jejeje: p
Ha aceptado mis fotos por favor !!
Una foto con mi mejor amigo e yo: $ !!
Esta soy yo totalmente desnuda por favor no env partition para nadie

Lede hvor spild Paris Hilton er efter hun fik f sans gsel
Jer og Mig !!! ... Se: p
Se p? Min fotos: p
Hej behage optage min foto !!
EN foto hos mig og min bedst ven: $ !!
Denne er mig hele bar behage vage vendlig og sende den ikk til nogle

Try to connect to remote IRC: john.free4people.net

Clear steps
============

1. Delete the Startup Mode of the virus (Start Menu-run-Enter "regedit" to go to the Registry and find the instructions and follow the prompts ):

　　
Code:
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ ShellServiceObjectDelayLoad]
"Modems" = "{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX }"

And corresponding:

　　
Code:
[HKEY_CLASSES_ROOT \ CLSID \ {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} \ InProcServer32]
@ = "Notice. dll"

2. restart the computer

3. delete an object
% System % \ msn.exe
% System % \ notice. dll
% Userprofile % \ new.txt
% Userprofile % \ {6-bit random volume .exe
The file name in the % Windows % directory is composed of the following characters and random numbers. The file size is approximately kb:

　　
Code:
Images
Photos2007 _
Album
Photo
Photo_album
Image0

For example:

Photos2007_79.zip (photos2007_79.scr)
Photo12.zip (photo12.scr)