|
IRC-Worm.ElSpy.227 Viruses Information
| Name: |
IRC-Worm.ElSpy.227 |
| Category: |
Viruses |
| Description:
|
Details
IRC-Worm.ElSpy.2278
This is an IRC worm that spreads through IRC channels using the mIRC client for spreading. The worm appears on a computer as the EL15_BMP.EXE DOS program. When this file is executed by a user, the worm installs itself into the system, and creates a temporary DOS batch helper that copies the worm file to the C:WindowsSystem directory and overwrites the mIRC SYSTEM.INI script file with new instructions.
The commands that are written to SYSTEM.INI mIRC script intercept several events:
when a new user enters the infected channel, (s)he is sent by the worm copy (the C:WINDOWSSYSTEMEL15_BMP.EXE file).
on connection to a channel, the worm informs a user with a "EL15_SPY" nick about an infected client sends the IP address of an infected user the name of the IRC server the user is logged on to, and the port address.
if the word "EL15" appears on the channel, the worm opens the C: drive on an infected computer as a file server (shares C: drive).
on text "are_u" the worm sends the message: "EL15_send_kisses_to_U_:)__come_on!" followed with an IP address of an infected user.
The worm contains the following text strings:
Designed by Del_Armg0____26 Juin 1999____Keep It Load!
MagicĒ%Software (c) 1999 |
Top Viruses Visited Pages:
Invader. - 231 visits
not-a-virus:RiskWare.Tool.RegPatch. - 69 visits
Worm.P2P.Harex. - 63 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 55 visits
Small.58. - 55 visits
Coito.64 - 53 visits
I-Worm.Mapson. - 45 visits
Win32.Hidra - 41 visits
Win16.Klon.1177 - 40 visits
Marine.500 - 34 visits
Random Viruses Pages:
Fab.175
Demolited.158
Aref.89
Pempe famil
Win95.Companio
HellAwaits.50
GW.120
WW.21
I-Worm.Myb
Murphy.Delirium.165
|
