Maximize
Bookmark

VX Heavens

Library Collection Sources Engines Constructors Simulators Utilities Links Forum

Worms

Alan Solomon

[Back to index] [Comments (0)]

IMPORTANT information for IRC participants.

The worms described below affect computers utilizing mIRC software to access IRC (Internet relay Chat) channels. People not using mIRC software are not affected.

Worms exploit a feature of mIRC software allowing key default script files to be overwritten when performing even the most common IRC functions -- like joining a discussion!

Worms can automatically download and replace your original default script files. Because the new script file contains the virus replication and payload code, the next time you participate in a discussion, you risk passing the worm to other innocent IRC participants.

To protect yourself from the worms described below, simply change the default download subdirectory from within the mIRC software. Doing so will prevent your computer from this type of attack. To change the default download subdirectory, perform the following actions:

  1. Start the mIRC software
  2. Click the mIRC menu option DCC | Options | Dirs | Edit
  3. Change the default download directory. Point to an alternate directory or folder name; the folder name is arbitrary, but it could just as easily be John or Susan.

(NOTE: The default download subdirectory is C:\MIRC) If necessary, create a new folder. See your operating system manual for details on creating new folders.)

Perhaps the most famous example of a Worm which widely spread is the Morris Internet Worm, which by exploiting debugging code in an early version of UNIX sendmail caused over 6,000 Internet servers to become so busy replicating it back and forth between themselves that they were no longer able to be accessed by their legitimate users, until reset. This was on the evening of 2 November, 1988, when the Internet was still in its infancy. Damage, due to loss of system usability, was estimated to be as high as $10 million.

deenesitfrplruua