Virus Database

IRC-Worm.Pron.576

Description IRC-Worm.Pron.576

This is an IRC worm that spreads through IRC channels using mIRC client for spreading. The worm is encrypted and has a very short size - just about 600 bytes, and appears as the PR0N.BAT file. When this file is executed on a computer, it copies itself with the PR0N.COM file and executes it as a DOS program. The worm code is built so that it can be executed as a DOS COM file as well as a DOS Batch, so the main worm routine (as a COM program) gains control and installs the worm into the system.
To infect the system, the worm uses a very silly way: it just copies its BAT file with the same name to the Windows system directory by using its direct name C:WINDOWSSYSTEM. If Windows is installed in any other directory, the worm fails to install itself. The worm then creates the WINSTART.BAT file and overwrites its with worm's code.
To spread itself via IRC channels, the worm overwrites SCRIPT.INI in the mIRC directory. The worm searches for this directory by four variants:
C:MIRC
C:MIRC32
C:PROGRA~1MIRC
C:PROGRA~1MIRC32

The worm's script is very short and just sends the worm's BAT file to all users joining an infected channel.
The worm also contains the "copyright" text:
IRC-pr0n.bat v1.0 (c) nUcLeii 1999

Check other viruses! Be aware! Use Antiviral Software

NotStoned.1349

Description NotStoned.1349

It is not a dangerous memory resident parasitic virus. The virus hooks INT 8, 28h, and in random time intervals searches for COM-files and writes itself to the file end. To prevent system hang-up the virus also hooks INT 9, 10h, 13h and checks DOS system data before executing infection routine.
If the system date is December 6, 1994 the virus decrypts and displays the message:
Don't legalize Marijuana. Your computer is not stoned.

Nov7.482

Description Nov7.482

It is a very dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM files that are executed. On November, 7th it displays:
Format all

and erases the hard drive sectors.

Home