Skip to content
1-888-762-8736(M-F 8:00am-5:00pm CST)
1-877-218-7353(M-F 8:00am-5:00pm CST)
href="http://www.trendmicro.com/us/enterprise/index.html" id="ENT-overview-test2" title="SEE ALL ENTERPRISE SOLUTIONS">Enterprise Overview
This backdoor may be hosted on a website and run when a user accesses the said website.
It executes commands from a remote malicious user, effectively compromising the affected system.
It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.
This backdoor opens the following port(s) where it listens for remote commands:
It connects to any of the following IRC server(s):
It joins any of the following IRC channel(s):
It executes the following commands from a remote malicious user:
This backdoor connects to the following URL(s) to download its configuration file:
It connects to the following URL(s) to download its component file(s):
It saves the files it downloads using the following names:
It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.
It sets the permission of the downloaded file to:
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Remove malware files dropped/downloaded by PHP_IRCBOT.AHC
Close all opened browser windows
Scan your computer with your Trend Micro product to delete files detected as PHP_IRCBOT.AHC . If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Connect with us on
| | | |