Home / malware

PDF

Worm:IRC/Prune.A

First posted on 15 October 2010.
Source: SecurityHome

Aliases :

Worm:IRC/Prune.A is also known as VBS/Prune.A (ESET), Email-Worm.VBS.Prune (Kaspersky), VBS/Carnival.ini (McAfee), VBS/Prune.B (Norman), VBS/Prune-A (Sophos), IRC.Worm.gen (Symantec), IRC.Prune.A (VirusBuster).

Explanation :

Worm:IRC/Prune.A is a detection for an Internet Relay Chat (IRC) configuration script commonly named "mirc.ini". The script attempts to distribute a VBScript copy of the worm to other chat users when connecting to IRC chat channels.
Top

Worm:IRC/Prune.A is a detection for an Internet Relay Chat (IRC) configuration script commonly named "mirc.ini". The script attempts to distribute a VBScript copy of the worm to other chat users when connecting to IRC chat channels. Installation Worm:IRC/Prune.A is installed by other malware, such as Virus:VBS/Entice, and may be present as the following: c:\mirc\mirc.ini By default, the IRC script is loaded and the instructions are interpreted by IRC chat clients (such as mIRC). Spreads via€¦ IRC channelsWhen an infected user joins and IRC channel, the worm distributes a copy of the VBScript to other users automatically. Payload Distributes other malware Worm:IRC/Prune.A contains instructions to send a copy of Virus:VBS/Entice as a file named "c:\windows\UN_Interview.TXT.vbs" to other chat users when connecting to IRC chat channels.

Analysis by Patrick Nolan

Last update 15 October 2010

 

TOP