W32/IRCBot-TG is a worm with backdoor functionality which allows a remote intruder to gain access and control over the computer.
W32/IRCBot-TG spreads to other network computers through pooly secured netword shares. The worm runs continously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
When first run, W32/IRCBot-TG copies itself to <System>\arman.exe.
The following registry entry is created to run the worm on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Arman
<path of worm executable>