Dorkbot

First detected in 2011, the Dorkbot family of Trojans and worms is associated with a vast botnet by the same name. ESG security researchers consider that all malware associated with Dorkbot poses a severe threat to a computer's integrity and should be removed immediately with the help of a reliable anti-malware program. Dorkbot uses IRC in order to relay orders to infected computers. The Dorkbot malware is often distributed using social engineering scams, including malicious social media spam messages and email spam. Variants of Dorkbot can be used to steal personal information and online banking credentials. There are many variants of malware associated with Dorkbot, with many different file names due to the many social engineering scams associated with this threat. One recent scam used to distribute Dorkbot malware involves fake Skype messages sent out by a Dorkbot worm variant. These link computer users to a backdoor Trojan which then allows criminals to install the Dorkbot worm on the victim's computer.

Most Dorkbot variants are installed through social media or instant messaging scams. These are often poorly written messages sent out on Skype, Facebook or Twitter containing a link that supposedly allows a computer user to access an image file. However, these image files will usually be ZIP or EXE files that contain executable files for either the Dorkbot worm itself or for a backdoor Trojan designed to allow criminals to install a Dorkbot variant on the victim's computer. Once installed, the Dorkbot variant will typically use a randomly generated file name and will make changes to the Windows Registry that ensure that Dorkbot is executed each time the victim starts up Windows.

Dorkbot malware can spread using removable drives. Whenever Dorkbot infects a computer, Dorkbot will copy itself to all drives detected on the victim's computer. It also creates an AutoRun file which allows the Dorkbot worm to start up automatically as soon as the drive is accessed. Dorkbot is also distributed using instant messaging and, in particular, IRC (Instant Relay Chat). Social networks such as Facebook and Vkontakte (a large social network in Russia) are also used to distribute the Dorkbot. IRC is also a big part of Dorkbot's payload since the main purpose of this malware threat is integrating the victim's computer into a botnet that receives its commands through IRC.

SpyHunter Detects & Remove Dorkbot