Virus Database

IRC-Worm.Banishing.2373

Description IRC-Worm.Banishing.2373

This is an mIRC worm combined with a memory resident parasitic stealth DOS virus. The DOS instance, when run, hooks INT 21h, and writes itself to the end of DOS COM and EXE files that are executed or opened. The virus is encrypted in COM and EXE files.
To spread its worm component via mIRC channels, it overwrites the SCRIPT.INI file in the C:MIRC directory with a set of instructions that send this SCRIPT.INI file to the channel upon file sending and receiving as well as to users that are leaving the channel. The worm does not send the infected DOS file to the channel, only to the SCRIPT.INI file.
The infected script also manifests itself with messages: when an infected client connects to a channel, it joins the "virus" channel and sends the following text there:
Will not the mountains quake and hills melt at the coming of the darkness?
Dark Banishing V1.0

If the text "virus" is found in the channel, the worm sends the same message to this channel.
The worm also contains the text strings:
Dark Banishing Version 1.0
Dark Banishing V1.0 By VxFaeRie

Check other viruses! Be aware! Use Antiviral Software

Imi.1536.f

Description Imi.1536.f

This is a benign memory resident parasitic viruses. It hooks INT 21h, and writes itself to the end of COM and EXE files that are executed. It contains the string "commandCOMMAND", and does not infect the COMMAND.COM file. On the 30th of March, it displays the following messages:
Hello!This is IMI 1.0b virus!

Imi.1536.g

Description Imi.1536.g

This is a benign memory resident parasitic viruses. It hooks INT 21h, and writes itself to the end of COM and EXE files that are executed. On the 30th of March, it displays the following messages:
Hello! This is [Pandora III ALPHA].
Writen by Blood Mary
Soochow Uni.B.A.
Or the same text in Chinese.

Home