IRC-Worm.DOS.Banishing.2373
| Alert Level : | Medium |
| Discovered: | Feb 13 2002 |
| Tag: | Internet Relay Chat Worms |
| Discoverer and Source: | http://www.kaspersky.com/ |
Malware Behavior and Technical Description
This is an mIRC worm combined with a memory resident parasitic stealth DOS virus. The DOS instance, when run, hooks INT 21h, and writes itself to the end of DOS COM and EXE files that are executed or opened. The virus is encrypted in COM and EXE files.
To spread its worm component via mIRC channels, it overwrites the SCRIPT.INI file in the C:\MIRC directory with a set of instructions that send this SCRIPT.INI file to the channel upon file sending and receiving as well as to users that are leaving the channel. The worm does not send the infected DOS file to the channel, only to the SCRIPT.INI file.
The infected script also manifests itself with messages: when an infected client connects to a channel, it joins the "virus" channel and sends the following text there:
Will not the mountains quake and hills melt at the coming of the darkness? Dark Banishing V1.0
If the text "virus" is found in the channel, the worm sends the same message to this channel.
The worm also contains the text strings:
Dark Banishing Version 1.0 Dark Banishing V1.0 By VxFaeRie
0
Removal IRC-Worm.DOS.Banishing.2373 instructions:
0
Need help? Live computer support via remote at SupportSpace |
