W32.IRCbot is spreading...

Heya,

Our company has the W32.IRCbot virus. It's jumping from computer to computer.

Starts out by crashing your machine (buffer overflow I'd imagine), when you reboot Symantec alerts you of 'a.bat' being found. Also it alerts W32.IRCbot associated with "Devsvc.exe".

I've removed the files, quarantined/deleted, removed registry keys, etc.

Getting rid of it doesn't seem like too big of a problem, it's keeping it from infecting other computers, seems like we're chasing our tail with this.

If any1 has any ideas, please let me know.

thanks,
~Luf.

 

Thanks for your response.

I figured it would come down to disconnecting & cleaning, just wanted to see if there was an easier way. (since this has spread to all of our divisions and we have centralized IT).

My only concern is....How is it spreading? The documentation that I have read on this specific virus states that it writes via buffer overflow using an exploit in MS security. But that was fixed back in 2005, with the Remote Code Execution patch. So it's kind of strange that it is infecting computers with that patch.

thanks,
~Luf.

 

I've seen several places that have stated the whole InterVideo = devsvc, but it is somehow linked to this virus being found. It's 100% consistant, that if Symantec finds this virus, it associates it with that file. And if you remove the keys from Run/Run Services in the registry, it will throw it back in there. The devsvc.exe has been found in multiple places, including: C:\, C:\Program Files\Symantec AntiVirus, C:\Windows, C:\Windows\System32. A normal valid process associated with InterVideo wouldn't have this elusive nature.

Also, I have seen the buffer overflow message before the computer reboots and Symantec recognizes the virus.

Symantec calls it "W32.IRCbot", is it possible that it is a variant and Symantec doesn't know the name? btw, we are running 10.1.0.394

thanks,
~Luf.