| Description:
|
Details
IRC-Worm.Banishing.2373
This is an mIRC worm combined with a memory resident parasitic stealth DOS virus. The DOS instance, when run, hooks INT 21h, and writes itself to the end of DOS COM and EXE files that are executed or opened. The virus is encrypted in COM and EXE files.
To spread its worm component via mIRC channels, it overwrites the SCRIPT.INI file in the C:MIRC directory with a set of instructions that send this SCRIPT.INI file to the channel upon file sending and receiving as well as to users that are leaving the channel. The worm does not send the infected DOS file to the channel, only to the SCRIPT.INI file.
The infected script also manifests itself with messages: when an infected client connects to a channel, it joins the "virus" channel and sends the following text there:
Will not the mountains quake and hills melt at the coming of the darkness?
Dark Banishing V1.0
If the text "virus" is found in the channel, the worm sends the same message to this channel.
The worm also contains the text strings:
Dark Banishing Version 1.0
Dark Banishing V1.0 By VxFaeRie |
