Troj/IRCBot-WL is an IRC backdoor Trojan for the Windows platform.
When run Troj/IRCBot-WL creates the files:
<Windows>\photos.zip - detected as Troj/IRCBot-WL
<System>\syshelps.dll - detected as Troj/IRCBot-WL
The following registry entry is created to run code exported by (07A01ECF-9D28-4B9C-A4D0-E439D416517F) on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
syshelps
(07A01ECF-9D28-4B9C-A4D0-E439D416517F)
The file syshelps.dll is registered as a COM object, creating registry entries under:
HKCR\CLSID\(07A01ECF-9D28-4B9C-A4D0-E439D416517F)