Hoax.VBS.Lara

Class Hoax
Platform VBS
Description

Technical Details

This is a silly IRC worm spreading through IRC channel and using mIRC client for spreading.

This is the first known modern Internet worm that spreads “Desktop Themes” files.

The worm appears on computer as the “LaraCroft.theme” filename.

On start this file the worm looks for mIRC-client, creates subsidiary VBS file in Windows directory and starts it. This file overwrites the mIRC script file SCRIPT.INI.
The new script sends the worm copy to any user that enters infected channel.