Tech Shout!

Security firm Sophos has cautioned internet users of the Troj/Stinx-V, an IRC backdoor Trojan for the Windows platform. According to Sophos it has received a number of reports of this Trojan from the wild.

Troj/Stinx-V, which is also known as Trojan.Brepibot.U, lets others access the computer, downloads code from the web and installs itself in the Registry.

When first run, Troj/Stinx-V copies itself to the Windows system folder with the name cmssr.exe and creates the following registry entry to run itself automatically:

HKLM\SOFTWARE\Microsoft\Windows\ CurrentVersion\Run\
ATD Direct CD
\cmssr.exe

The Trojan connects to a preconfigured IRC server and joins a specific channel. A remote attacker can then gain access and control over the infected computer.

Click here to download the Sophos’ virus identity (IDE) file for Troj/Stinx-V, which includes detection for Troj/Melost-A, Troj/AdDrop-A, Troj/Banker-BKI, Troj/Flooder-GJ, Troj/VB-BGY, W32/Areses-K and Troj/Agent-BRK.