Virus Database

IRC-Worm.Kazimas

Description IRC-Worm.Kazimas

This is an IRC virus-worm that spreads itself via mIRC channels. It appears as a MILBUG_A.EXE DOS EXE file about 10Kb in length. When it is executed, it copies itself to several disk directories under different names:
C:WINDOWSKAZIMAS.EXE
C:WINDOWSSYSTEMPSYS.EXE
C:ICQPATCH.EXE
C:MIRCNUKER.EXE
C:MIRCDOWNLOADMIRC60.EXE
C:MIRCLOGSLOGGING.EXE
C:MIRCSOUNDSPLAYER.EXE
C:GAMESSPIDER.EXE
C:WINDOWSFREEMEM.EXE

The worm then infects the installed mIRC client in the C:MIRC directory: it creates a new script file SCRPT.INI and overwrites the MIRC.INI configuration file. If the mIRC client is installed in any other path, the worm fails to infect it.
The worm modifies the MIRC.INI files that customize the mIRC client. There are several options set, for instance a user's identity is set to "kazimas", and the additional script file SCRPT.INI is included in auto-run scripts.
The SCRPT.INI file, that is dropped by the worm, contains several instructions that switch a user to the "Chat2K" channel, send messages to there, and the most important: send to the channel the worm copy (the C:WINDOWSKAZIMAS.EXE file).
The worm also overwrites the C:AUTOEXEC.BAT file with instructions that restore worm's copies (if they are erased) and execution:
@copy c:windowssystempsys.exe c:windowskazimas.exe >nul
@copy c:windowskazimas.exe c:kazimas.exe >nul
@c:kazimas.exe >nul
@cls

Check other viruses! Be aware! Use Antiviral Software

Fist.927

Description Fist.927

It's a harmless memory resident encrypted virus. It infects COM- and EXE-files and MBR of the hard disk in a standard way. The MBR is hit when an infected file is started. The virus saves its part and the MBR sector at the location 0/0/2 (track/head/sector). The virus infects memory while booting from an infected disk. After that it infects files only. The virus hooks INT 13h, 1Ch, 21h.
This virus is a MBR-generation of the "Fist" file viruses.

FITA.401

Description FITA.401

It is a dangerous nonmemory resident parasitic virus. It searches for .COM files, then writes itself to the end of the file. The virus performs several anti-viruses installation check calls, and if they are installed, it halts the computer. The virus contains the text string:
Fist in the air, in the land of hypocrisy

Home