Virus Database

Jeff.812

Description Jeff.812

It is a very dangerous nonmemory resident parasitic virus. It searches for .COM files and writes itself to the end of the file. On July, 7th it displays:
JEFF is visiting your harddiskall

and erases FAT of current disk.

Check other viruses! Be aware! Use Antiviral Software

IRC-Worm.Godog.a

Description IRC-Worm.Godog.a

This is a virus worm that spreads via IRC channels. It is a DOS program, and when run, it copies itself to the MIRC directory (if MIRC software is installed) with the "GhostDog.exe" name, and creates the SCRIPT.INI mIRC script file here. This script contains instructions that send a worm copy to users that enter the infected IRC channel. The script also hides messages if they contain the "virus" or "worm" words.
The main worm feature is the fact that it generates polymorphic instructions in the SCRIPT.INI file. These instructions are mixed in order; characters are randomly uppper and lower-cased; there are a random number of random comment-lines here, for example:
n0=$40Yw840RIGlx6Amlp7G0JaZ4QTs840N
n1=On 1^tExt^*WoRm*^*^{ /Ignore $nick | /closeMsg $NiCk }
n2=$HyX5NMq840KBAfrpTGfj7Z0DuT5J6m840GXWb1lQcbe7V0ZpT5F5j840CTRwihMYW
Despite the strange appearance, the script commands maintain their functionality.

IRC-Worm.Kazimas

Description IRC-Worm.Kazimas

This is an IRC virus-worm that spreads itself via mIRC channels. It appears as a MILBUG_A.EXE DOS EXE file about 10Kb in length. When it is executed, it copies itself to several disk directories under different names:
C:WINDOWSKAZIMAS.EXE
C:WINDOWSSYSTEMPSYS.EXE
C:ICQPATCH.EXE
C:MIRCNUKER.EXE
C:MIRCDOWNLOADMIRC60.EXE
C:MIRCLOGSLOGGING.EXE
C:MIRCSOUNDSPLAYER.EXE
C:GAMESSPIDER.EXE
C:WINDOWSFREEMEM.EXE

The worm then infects the installed mIRC client in the C:MIRC directory: it creates a new script file SCRPT.INI and overwrites the MIRC.INI configuration file. If the mIRC client is installed in any other path, the worm fails to infect it.
The worm modifies the MIRC.INI files that customize the mIRC client. There are several options set, for instance a user's identity is set to "kazimas", and the additional script file SCRPT.INI is included in auto-run scripts.
The SCRPT.INI file, that is dropped by the worm, contains several instructions that switch a user to the "Chat2K" channel, send messages to there, and the most important: send to the channel the worm copy (the C:WINDOWSKAZIMAS.EXE file).
The worm also overwrites the C:AUTOEXEC.BAT file with instructions that restore worm's copies (if they are erased) and execution:
@copy c:windowssystempsys.exe c:windowskazimas.exe >nul
@copy c:windowskazimas.exe c:kazimas.exe >nul
@c:kazimas.exe >nul
@cls

Home