This is an IRC worm that spreads via mIRC channels. The worm code itself is
a randomly named DOS EXE file. When it is executed, the worm copies itself
with the LOA.EXE name to the Windows directory and registers this file in
the system registry in the auto-run section:
“Life of Agony”=”loa.exe”
When the worm locates the MIRC.INI file, it writes to there several
instructions that disable the mIRC security settings and creates its script
file that contains commands that send the worm’s EXE file to the channel.
The worm manifests itself as anti-virus programs that searche and delete
the DM-Setup mIRC worm (the worm actually does delete DM-Setup
files if they present on disks). It then displays the following messages:
You are about to scan your harddrive for the DMSetup virus, it is
crucial that you run this program without mIRC active, so if you
are still in mIRC at the moment, type /EXIT before you continue.
Press any key if mIRC is not active…
The worm also displays other messages that depend on the current date:
PowerBit anti-virus v3.34, (C)opyrighted 1999 by PB Systems.
SHAREWARE – REGISTER?
Scan completed, no viruses were found.
The Ultimate Chaos Website 2 – http://sourceofkaos.com/homes/ultchaos
WaReZ SCaNNeR bY oDELiOFiLThY [SuCK]… ViSiT #warez !
nO WaReZ wErE FoUnD aT DRiVe C: !!!
DrSolomon Anti-Virus Toolkit v10.00 – SPECIAL EDITION –
Scanning memory (DOSUMBHMAXMS)…
No viruses found in memory
No viruses were found.
ScanDisk 2.00, (C)Copyright Microsoft Corp 1981-1998.
Checking critical areas…
No errors were detected.
Anti-Back-Orifice II.A, detects/removes all BO-instances from your system.
BO was not found in the registry
System clean, visit http://sourceofkaos.com/homes/ultchaos for updates.
TERA SPOOF-INSTALLER VERSION 6.66
located at x0FA56D6A4h
Failed to install spoof, SPSOCK64.DLL missing.
WinGater by Terminatius [Finds installed WinGates at your system].
No WinGates found, go to Undernet, #wingater for help.
Thunderbyte virus-detector v9.24, – (C) Copyright 1989-1999 Thunderbyte B.V.
No viruses were found.
Anti-Nuke written by cDc – Cult of the Dead Cow.
Checking V86 interrupts…
No polling detected
No nuke-programs found.
LOA”s Kill-DMSetup version 2.2, – SHAREWARE
KILL-CIH v2.0. –> kills all known CIH-strains! <--
CIH has not been detected at your system.
When the worm is started with the /SECRET argument, it displays the following message:
=[ Life of Agony 1.30, (c) 1998 by T-2000 / Immortal Riot ]=
Hi! I am the [LIFE OF AGONY] worm, and I”m gonna fuck you up REAL bad!
LIFE OF AGONY