WORM_IRCBOT.MAC

This worm may be downloaded unknowingly by a user when visiting malicious Web sites.

It drops copies of itself.

It registers itself as a system service to ensure its automatic execution at every system startup. It does this by creating registry keys/entries.

It searches the network for certain shares, into which it attempts to drop copies of itself. It uses a list of user names and passwords to access password-protected shares.

It connects to a certain Web site to send and receive information. It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

Related Items