GT Bot Accessdiver

Interview with Lockdown | Main Page | Trojan List | NoHack | SwatIt | Submit a Trojan

This GT Bot Trojan installs all its files to c:\windows\system\fonts. It creates one registry key, but out side that, it does not alter any keys. It monitors IRC channels for text commands and executes different functions if the proper commands are entered in a channel the bot is present in. Mirc2.ini is responsible (among other functions) for writing and launching the pepsi.vbs file. The pepsi.vbs file in turn launches the Pepsi.exe DDOS tool. It also contains several text commands that will execute if typed into a channel. Mirc3.ini is a borrowed bnc script. It accepts connections from a remote client, has a bit of a security feature to prevent unauthorized use prevent unauthorized use by other hackers, and then allows the remote client to use that GT Bot as it's access to the IRC server the GT Bot Trojan is logged onto. Mirc.ini is the actual mirc.ini file, with a DDOS script included in it.

PR.INI sets up variables for the other scripts, it sets a login password and only accepts that password if the IP address contains "207.195.". it sets the GT Bot nick to a name picked from the temp.scr and appends a random number to it. The Trojan code reads //nick $read temp.scr $+ $r(1,9). PR.INI also has detection monitoring, and attempts to re-hide the GT Bot if it is discovered. It also searches for earlier GT Bot Trojans located in C:\WINDOWS\INF\g, C:\WINDOWS\web32\ and C:\WINDOWS\bero\ and if found, deletes all the bot files in those folders. It also contains various IRC DDOS routines.

Before you make any changes to the registry, it is recommended that you first make a back up

Back to Links
Back to Top of GT Bot Information Page
Submit New bots to golcor@trojaninfo.com