|
|
IRC-Worm.Pron.57 Viruses Information
| Name: |
IRC-Worm.Pron.57 |
| Category: |
Viruses |
| Description:
|
Details
IRC-Worm.Pron.576
This is an IRC worm that spreads through IRC channels using mIRC client for spreading. The worm is encrypted and has a very short size - just about 600 bytes, and appears as the PR0N.BAT file. When this file is executed on a computer, it copies itself with the PR0N.COM file and executes it as a DOS program. The worm code is built so that it can be executed as a DOS COM file as well as a DOS Batch, so the main worm routine (as a COM program) gains control and installs the worm into the system.
To infect the system, the worm uses a very silly way: it just copies its BAT file with the same name to the Windows system directory by using its direct name C:WINDOWSSYSTEM. If Windows is installed in any other directory, the worm fails to install itself. The worm then creates the WINSTART.BAT file and overwrites its with worm's code.
To spread itself via IRC channels, the worm overwrites SCRIPT.INI in the mIRC directory. The worm searches for this directory by four variants:
C:MIRC
C:MIRC32
C:PROGRA~1MIRC
C:PROGRA~1MIRC32
The worm's script is very short and just sends the worm's BAT file to all users joining an infected channel.
The worm also contains the "copyright" text:
IRC-pr0n.bat v1.0 (c) nUcLeii 1999 |
Top Viruses Visited Pages:
Invader. - 233 visits
not-a-virus:RiskWare.Tool.RegPatch. - 70 visits
Worm.P2P.Harex. - 65 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 59 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 47 visits
Win16.Klon.1177 - 42 visits
Win32.Hidra - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
ByteWipe.120
Freedom Famil
ThatsAll.61
Mixx.57
Macro.Word97.Tangga
Licei.150
Macro.Word.Nae
Predator.106
Trojan-Dropper.Win32.Small.i
Grigory.99
|
|
