|
|
IRC-Worm.Claw.251 Viruses Information
| Name: |
IRC-Worm.Claw.251 |
| Category: |
Viruses |
| Description:
|
Details
IRC-Worm.Claw.2513
This is a very dangerous memory resident encrypted parasitic virus. It hooks INT 21h, and writes itself to the end of COM and EXE files when they are accessed. Then it looks for COM and EXE files in the current directory and infects them. The virus also creates a hidden file in the root directory on the C: drive, writes its copy to there and adds to the AUTOEXEC.BAT an instruction to execute this file. The virus then infects WIN.COM and COMMAND.COM in the Windows directory.
To infect mIRC and spread via IRC channels, the virus creates two files in the C:MIRC directory: the MIRC_SYS.INI virus script file and DOS COM virus dropper CYBER.COM. Then it patches the MIRC.INI file with an instruction to load infected MIRC_SYS.INI file on IRC client start-up. The virus script switches off mIRC security (warning messages) and sends the virus dropper into the IRC channel at the moment a user disconnects from the channel.
On September 1st, depending on a random value, the virus erases the FLASH BIOS. To do this, the virus calls extended BIOS functions.
When the virus dropper starts, it displays the texts:
Clawfinger
The virus also contain encrypted strings:
Do you know how it feels to be down in the dirt with a bullet
in yer breast and blood on yer shirt Lying in a bloodpool down
in a pit covered with the corpse and the blood and the shit
How does it feel to have a gun at yer head when ya know that
you'd be much better off dead Freedom has a price and that price
is blood so chase the motherfucker right down in da mud
[ WARFAIR - CLAWFINGER ] |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 72 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win16.Klon.1177 - 42 visits
Win32.Hidra - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Tchantches.330
Sink.40
Lame.9
TypoBoo
Chance.
Antibase.190
Macro.Word.NoPrin
Win32.HLLP.Ime
HLLC.CP-Ma
Paraguay.275
|
|
