IRC-Worm.DOS.Loa

Parent class: VirWare

Viruses and worms are malicious programs that self-replicate on computers or via computer networks without the user being aware; each subsequent copy of such malicious programs is also able to self-replicate. Malicious programs which spread via networks or infect remote machines when commanded to do so by the “owner” (e.g. Backdoors) or programs that create multiple copies that are unable to self-replicate are not part of the Viruses and Worms subclass. The main characteristic used to determine whether or not a program is classified as a separate behaviour within the Viruses and Worms subclass is how the program propagates (i.e. how the malicious program spreads copies of itself via local or network resources.) Most known worms are spread as files sent as email attachments, via a link to a web or FTP resource, via a link sent in an ICQ or IRC message, via P2P file sharing networks etc. Some worms spread as network packets; these directly penetrate the computer memory, and the worm code is then activated. Worms use the following techniques to penetrate remote computers and launch copies of themselves: social engineering (for example, an email message suggesting the user opens an attached file), exploiting network configuration errors (such as copying to a fully accessible disk), and exploiting loopholes in operating system and application security. Viruses can be divided in accordance with the method used to infect a computer:

• file viruses
• boot sector viruses
• macro viruses
• script viruses

Any program within this subclass can have additional Trojan functions. It should also be noted that many worms use more than one method in order to spread copies via networks.

Class: IRC-Worm

This type of worm spreads via Internet Relay Chat. Like email worms, IRC Worms have two ways of spreading via IRC channels. The first involves sending an URL which leads to a copy of the worm. The second technique is to send an infected file to an IRC channel user. However, the recipient of the infected file has to accept the file, save it to disk, and open (launch) it.

Read more

Platform: DOS

No platform description

Description

Technical Details

This is an IRC worm that spreads via mIRC channels. The worm code itself is a randomly named DOS EXE file. When it is executed, the worm copies itself with the LOA.EXE name to the Windows directory and registers this file in the system registry in the auto-run section:

LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunServices:
"Life of Agony"="loa.exe"

When the worm locates the MIRC.INI file, it writes to there several instructions that disable the mIRC security settings and creates its script file that contains commands that send the worm's EXE file to the channel.

The worm manifests itself as anti-virus programs that searche and delete the DM-Setup mIRC worm (the worm actually does delete DM-Setup files if they present on disks). It then displays the following messages:

You are about to scan your harddrive for the DMSetup virus, it is
crucial that you run this program without mIRC active, so if you
are still in mIRC at the moment, type /EXIT before you continue.
Press any key if mIRC is not active...

The worm also displays other messages that depend on the current date:

PowerBit anti-virus v3.34, (C)opyrighted 1999 by PB Systems.
SHAREWARE - REGISTER?
YES!
Scan completed, no viruses were found.
The Ultimate Chaos Website 2 - http://sourceofkaos.com/homes/ultchaos
Visit me...
NOW!
Not detected.
WaReZ SCaNNeR bY oDELiOFiLThY [SuCK]... ViSiT #warez !
SeLF CHeCK:
oKeY
nO WaReZ wErE FoUnD aT DRiVe C: !!!
DrSolomon Anti-Virus Toolkit v10.00 - SPECIAL EDITION -
Scanning memory (DOSUMBHMAXMS)...
No viruses found in memory
No viruses were found.
ScanDisk 2.00, (C)Copyright Microsoft Corp 1981-1998.
Checking critical areas...
OK
No errors were detected.
Anti-Back-Orifice II.A, detects/removes all BO-instances from your system.
Checking registry...
BO was not found in the registry
System clean, visit http://sourceofkaos.com/homes/ultchaos for updates.
TERA SPOOF-INSTALLER VERSION 6.66
Checking shadow-RAM...
located at x0FA56D6A4h
Failed to install spoof, SPSOCK64.DLL missing.
WinGater by Terminatius [Finds installed WinGates at your system].
Locating registry:
REGISTRY.REG
No WinGates found, go to Undernet, #wingater for help.
Thunderbyte virus-detector v9.24, - (C) Copyright 1989-1999 Thunderbyte B.V.
SANITY CHECK:
OK!
No viruses were found.
Anti-Nuke written by cDc - Cult of the Dead Cow.
Checking V86 interrupts...
No polling detected
No nuke-programs found.
LOA''s Kill-DMSetup version 2.2, - SHAREWARE
Checking memory...
OK
Completed!
KILL-CIH v2.0. --> kills all known CIH-strains! <--
Memory check...
passed
CIH has not been detected at your system.

When the worm is started with the /SECRET argument, it displays the following message:

=[ Life of Agony 1.30, (c) 1998 by T-2000 / Immortal Riot ]=
Hi! I am the [LIFE OF AGONY] worm, and I''m gonna fuck you up REAL bad!
LIFE OF AGONY

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com