Sophos

Troj/Zapchas-V

Aliases
  • Backdoor.Win32.mIRC-based
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Protection available since 6 October 2005 02:52:35 (GMT)
Detected by All Sophos products
Download Free virus scan
Download the Threat Detection Test
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

Troj/Zapchas-V is a Trojan for the Windows platform.

Troj/Zapchas-V runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.

When Troj/Zapchas-V is installed the following files are created:

<System>\drivers\aliases.ini
<System>\drivers\control.ini
<System>\drivers\join.txt
<System>\drivers\mad.exe
<System>\drivers\mirc.ico
<System>\drivers\mirc.ini
<System>\drivers\nicks.txt
<System>\drivers\perform.ini
<System>\drivers\popups.ini
<System>\drivers\remote.ini
<System>\drivers\script.ini
<System>\drivers\servers.ini
<System>\drivers\sup.bat
<System>\drivers\sup.reg
<System>\drivers\svchost.exe
<System>\drivers\users.ini

The file script.ini is also detected as Troj/Zapchas-V. The file svchost.exe is a version of the mIRC chat application. The other files are not inherently dangerous but may be safely deleted.

The following registry entries may be set to run the mIRC client upon system start:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
svchost.exe
<System>\drivers\svchost.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
system32
<System>\drivers\svchost.exe

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer