| 1. | IRC-Worm.BAT.Spth
This is a polymorpic worm is written in Batch script with the extensions Windows
2000/XP (cmd.exe). The worm contains two parts: polymorphic generator and
main body. The polymorphic generator reconstruces the main body on each
start of batch file. The worm creates its droppers with the files:...
|
| 2. | IRC-Worm.DOS.Banishing.2373
This is an mIRC worm combined with a memory resident parasitic
stealth DOS virus. The DOS instance, when run, hooks INT 21h, and
writes itself to the end of DOS COM and EXE files that are executed or
opened. The virus is encrypted in COM and EXE files.
To spread its worm component via mIRC channels,...
|
| 3. | IRC-Worm.DOS.Claw.2513
This is a very dangerous memory resident encrypted parasitic virus. It hooks
INT 21h, and writes itself to the end of COM and EXE files when they are
accessed. Then it looks for COM and EXE files in the current directory and
infects them. The virus also creates a hidden file in the root directory...
|
| 4. | IRC-Worm.DOS.ElSpy.2278
This is an IRC worm that spreads through IRC channels using the mIRC client for
spreading. The worm appears on a computer as the EL15_BMP.EXE DOS program.
When this file is executed by a user, the worm installs itself into the
system, and creates a temporary DOS batch helper that copies the worm...
|
| 5. | IRC-Worm.DOS.Godog.a
This is a virus worm that spreads via IRC channels. It is a DOS program, and when run, it copies itself to the MIRC directory (if MIRC software is installed) with the "GhostDog.exe" name, and creates the SCRIPT.INI mIRC script file here. This script contains instructions that send a worm copy to...
|
| 6. | IRC-Worm.DOS.Kazimas
This is an IRC virus-worm that spreads itself via mIRC channels. It appears
as a MILBUG_A.EXE DOS EXE file about 10Kb in length. When it is executed,
it copies itself to several disk directories under different names:
C:\WINDOWS\KAZIMAS.EXE
C:\WINDOWS\SYSTEM\PSYS.EXE
C:\ICQPATCH.EXE
C:...
|
| 7. | IRC-Worm.DOS.Loa
This is an IRC worm that spreads via mIRC channels. The worm code itself is
a randomly named DOS EXE file. When it is executed, the worm copies itself
with the LOA.EXE name to the Windows directory and registers this file in
the system registry in the auto-run section:...
|
| 8. | IRC-Worm.DOS.Mabra.a
This is a silly IRC worm that spreads through IRC channels using mIRC
client for spreading. The worm appears on a computer as the DOS EXE file with
MABRA.EXE, CDMAN.EXE, or GLADYS.EXE filename (depending on the worm's version),
and about 14K in file size. When this file is executed by a user, the...
|
| 9. | IRC-Worm.DOS.Milbug.a
This is an IRC virus-worm that spreads itself via mIRC channels. It appears
as a MILBUG_A.EXE or MILBUG_B.EXE DOS EXE file about 10Kb in length. The
file name depends on the worm version. When the worm file is executed, it
overwrites the SCRIPT.INI file in the C:\MIRC directory with its own...
|
| 10. | IRC-Worm.DOS.MrWormy.1198
This is a harmless encrypted parasitic virus-worm that spreads via mIRC
and PIRCH chat channels. To install itself into the system, the virus
patches chat-client scripts and creates the infected DOS COM file MYPIC.COM
in the \WINDOWS directory, and this file has Hidden and Read-only attributes
set....
|
