McAfee > Theat Center > Virus Detail Page

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

When run, it copies itself to "%windir%\system\.exe", where %windir% is the directory Windows is installed in. It adds the following registry key so that it launches itself everytime after a restart:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ RunServices\Network Socket Update

Other Registry keys which are created are :

HKEY_CLASSES_ROOT\NMCHANXCON
HKEY_CLASSES_ROOT\NMCHANXCON\Join
HKEY_CLASSES_ROOT\NMUSRXCON

It connects to an IRC channel and accepts commands from there. The commands are related to performing just some of the following actions on the victim's computer, and many more.

Symptoms

Method of Infection

Running the trojan installs it on the computer.

Removal

All Users :
Use specified engine and DAT files for detection and removal. Delete files which contain this detection.

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

Characteristics -

When run, it copies itself to "%windir%\system\.exe", where %windir% is the directory Windows is installed in. It adds the following registry key so that it launches itself everytime after a restart:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ RunServices\Network Socket Update

Other Registry keys which are created are :

HKEY_CLASSES_ROOT\NMCHANXCON
HKEY_CLASSES_ROOT\NMCHANXCON\Join
HKEY_CLASSES_ROOT\NMUSRXCON

It connects to an IRC channel and accepts commands from there. The commands are related to performing just some of the following actions on the victim's computer, and many more.

Symptoms

Symptoms -

Method of Infection

Method of Infection -

Running the trojan installs it on the computer.

Removal -

Removal -

All Users :
Use specified engine and DAT files for detection and removal. Delete files which contain this detection.

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A