secure2.bat - Dangerous
secure2.bat
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
Allows unauthorized access to the infected machine.
When Backdoor.IRC.Zcrew.C is executed, it performs the following actions:
Creates the following files in the %System%\instsrv folder:
001.config; Configure; COPYING; cygregex.dll; cygwin1.dll; firedaemon.exe; foxdg.exe; hideapp.exe; ident.exe; inst.bat; iroffer.cron; KILL.EXE;
lrs.reg; Makefile.config; mybot.ignl; mybot.ignl.bkup; mybot.ignl.tmp; new.txt; README; rn.bat; secure1.bat; secure2.bat; startsecure.bat; test.bat; WHATSNEW
Creates the following nonmalicious files in the folder, %System%\instsrv\src:
admin.c; dccchat.c; defines.h; display.c; globals.h; headers.h; iroffer.c; iroffer.cron; misc.c; plugins.c; transfer.c; upload.c; utilities.c
Starts foxdg.exe, which is the Iroffer application, as a service process.
Manual removal:
Navigate to the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
amd delete the value: "Bat"="C:\winnt\system32\instsrv\secure2.bat"
Also you must delete the nonmalicious files:
Navigate to the %System%\instsrv and %System%\instsrv\src folders and delete any files.