IRC-Worm.DOS.Mabra.a

0 0

This is a silly IRC worm that spreads through IRC channels using mIRC client for spreading. The worm appears on a computer as the DOS EXE file with MABRA.EXE, CDMAN.EXE, or GLADYS.EXE filename (depending on the worm's version), and about 14K in file size. When this file is executed by a user, the worm copies itself into C:\WINDOWS, C:\WINDOWS\SYSTEM or C:\WINDOWS\SYSTEM32 directory (depending on worm version), and overwrites the mIRC script file SCRIPT.INI in the C:\MIRC directory. The new script sends the worm copy to any user that enters an infected channel.

Depending on the system time, the worm erases the C:\WINDOWS\WIN.COM file.