Troj/IRCBot-W

Please follow the instructions for removing Trojans.

Change any data that may have become compromised.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
UsrManagementConf = umcss.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
UsrManagementConf = umcss.exe

and delete them if they exist.

Close the registry editor.

Troj/IRCBot-W is an IRC backdoor Trojan which allows a malicious user remote access to an infected computer over an IRC connection.

This Trojan will copy itself into the Windows System32 folder as UMCSS.EXE
and set one or both of the following registry entries so that it is executed every
time the system is restarted:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
UsrManagementConf = umcss.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
UsrManagementConf = umcss.exe

Troj/IRCBot-W can be used by the remote intruder to initiate UDP and SYN flood attacks against target computers and glean CD keys from several popular games including:

Neverwinter Nights
Command & Conquer Generals
Battlefield Vietnam
Battlefield 1942 Road To Rome
Battlefield 1942
Unreal Tournament 2004
Unreal Tournament 2003
Half-Life

The remote intruder may also be able to download a file onto the compromised computer and execute it.