Email-Worm.VBS.Sonne

Technical Details

This is an IRC worm that spreads through IRC channels using mIRC client for
spreading. The worm appears on a computer as the “Sonnet.vbe” VBE program.
When this file is executed by a user, the worm installs itself into the
Windows directory and overwrites the mIRC SYSTEM.INI script
file with new instructions.

The commands that are written to the SYSTEM.INI mIRC script intercept several
events:

– when a new user enters the infected channel, (s)he is sent by the worm
copy (the C:WINDOWSSONNET.VBE file).