What We Do
- Your Needs
  Security Goals
  INDUSTRIES & SECTORS
  COMPANY SIZE
  PRODUCT FEATURES
  CASE STUDIES
  - Education
  - Financial
  - Government
  - Healthcare
  - Technology
  - Other
- Why Sophos
  Company Overview
  Our People
  INNOVATIVE TECHNOLOGY
  ALERT SERVICES
- Products
  Product Features
  Product Families
  - Unified (formerly Astaro)
  - Endpoint
  - Network
  - Encryption
  - Web
  - Email
  - Mobile
  Complete Security
  - All-in-One Security Suites
  PRODUCTS BY NAME
  - Products A-Z
  Free Tools
  Next Steps
  RESOURCES
Getting Answers
- Support
  FIND AN ANSWER
  Support by Product
  - > View all
  Maintain your Product
  Hire an Expert
  WHAT'S POPULAR
- Threat Center
  THREAT ANALYSIS
  THREAT STATISTICS
  WHAT'S POPULAR
  Threat Definitions
  - A-Z of Threats
  THREAT MONITORING
What's Happening
- Security News/Trends
  SECURITY HUBS
  LIBRARY
  Whats Popular
  WHAT'S NEW
  Community
  - Naked Security
  - Connect with Us
  IT SECURITY TRAINING
  ANATOMY OF AN ATTACK
- Partners
  RESELLER PARTNERS
  - Overview
  - Why Partner with Sophos?
  Managed Service Providers
  - Overview
  SYSTEM INTEGRATORS
  - Overview
  OEM and Technology
  WHAT'S POPULAR

Troj/IrcBot-AKS

Category:	Viruses and Spyware	Protection available since:	08 Dec 2012 14:56:20 (GMT)
Type:	Trojan	Last Updated:	08 Dec 2012 14:56:20 (GMT)
Prevalence:

Download our free Virus Removal Tool - Find and remove threats your antivirus missed

Troj/IrcBot-AKS exhibits the following characteristics:

File Information

File type: Windows executable

Runtime Analysis

Copies Itself To

F:/RECYCLER/R-1-5-21-1482476501-1644491937-682003330-1013/hostsv.exe

Dropped Files

F:/RECYCLER/R-1-5-21-1482476501-1644491937-682003330-1013/Desktop.ini

Modified Files

C:\RECYCLER
- Set the readonly flag

Registry Keys Created

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Taskman
c:\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013\hostsv.exe

DNS Requests

tv.zabetwo.com

Try Sophos products for free
Download now