Backdoor:Win32/WinBot

Detected by Microsoft Defender Antivirus

Aliases: Backdoor.IRC.Zapchat (Kaspersky) Troj/Zapchas-CN (Sophos) TROJ_ZAPCHAS.CN (Trend Micro)

Summary

Backdoor:Win32/WinBot opens a backdoor on TCP port 113 and UDP port 30167, connects to an IRC channel, and downloads and installs other files. Backdoor:Win32/WinBot also includes keylogger capabilities. Some variants of Backdoor:Win32/WinBot include the Win32/Parite virus, possibly as a result of cross-infection. Win32/Parite infects portable executable files on local drives and accessible network shares.

Manual removal is not recommended for this threat. To detect and remove this threat and other malicious software that may have been installed, run a full-system scan with an up-to-date antivirus product such as Microsoft Security Essentials, or the Microsoft Safety Scanner. For more information about using antivirus software, see http://www.microsoft.com/security/antivirus/av.aspx.

Backdoor:Win32/WinBot

Summary

What to do now

Technical information

Threat behavior

Prevention

Symptoms

System changes