|
IRC.Forca.Worm is an IRC worm.
It contains desktop modification settings and also VBScript
code. The worm may be received from other infected users of
mIRC, an Internet Relay Chat client.
This is an IRC worm, designed
to distribute itself through mIRC configuration files. This
script is designed for computers that run the Microsoft !Plus
add-on. This script may be received while chatting with an
infected user during an IRC session. The script may arrive
in the name "LaraCroft.theme."
If the script is run, it writes
a small script in the Windows folder named "Win.vbe." This
script is coded to modify the file "Script.ini" in one of
the following possible locations:
- C:\Mirc
- D:\Mirc
- E:\Mirc
- C:\Progra~1\Mirc
- D:\Progra~1\Mirc
- E:\Progra~1\Mirc
The file Script.ini is modified
to send a note to the host system with the following text:
"Hi there!! Check out tiz Lara
Croft desktop theme: Click on the Preview screen saver button,
its the best i've ever seen"
The script "LaraCroft.theme"
contains instructions to copy itself into the Windows folder
and create the file C:\Test.bat. The script contains instructions
to modify the computer and desktop settings through the theme
configuration setting sections.
|
