Class Hoax
Platform VBS

Technical Details

This is a silly IRC worm spreading through IRC channel and using mIRC client for spreading.

This is the first known modern Internet worm that spreads “Desktop Themes” files.

The worm appears on computer as the “LaraCroft.theme” filename.

On start this file the worm looks for mIRC-client, creates subsidiary VBS file in Windows directory and starts it. This file overwrites the mIRC script file SCRIPT.INI.
The new script sends the worm copy to any user that enters infected channel.

Find out the statistics of the threats spreading in your region