Name:

Trojan.Ircbrute.im

Added:

December 15, 2011

Type:

Trojan

Risk:

Low

Payload:

N/A

At risk systems:

Windows 95/98/ME/XP/NT/2003

Malware problems?   We can help.  Free Removal Tools.

Description:

When Trojan.Ircbrute.im is executed, it performs the following activities:

After execution, it drops the following files:

%WINDIR%\system32\WinDefend.exe
%WINDIR%\WinDefend.exe

It creates/modifies the following registry entries:

Windows Defense Service = "C:\windows\WinDefend.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Windows Defense Service = "C:\windows\WinDefend.exe"
HKU\Software\Microsoft\Windows\CurrentVersion\Run

"WinDefend.exe" runs every time Windows starts

Also, it modifies the Safeboot registry keys in order to try and disable Safe Mode.