Summary
Summary
Action- More Information
| Detected by | All Sophos products |
|---|---|
Action
- Summary
- Action
- More Information
Please read the instructions for removing worms.
More Information
mIRC/Movie-A spreads over IRC channels. It sends a file as MOVIE.AVI.PIF. Because Windows does not display the extension .PIF by default, the user may think the file which just downloaded is an AVI file.
When run it copies itself to C:\MIRC\SCRIPT.INI. When mIRC is next started it copies itself to C:\WINDOWS\WINSTART.BAT and C:\MIRC\MIRC.BAT but then immediately runs and deletes MIRC.BAT.
Run as a batch program it copies itself to another three locations: C:\WINDOWS\SYSTEM\MOVIE.AVI.PIF, C:\WINDOWS\START MENU\PROGRAMS\STARTUP\WIN and C:\C0MMAND.COM, spelled with a zero in place of the letter 'O'.
|
