Trojan.IRC.KarmaHotel

Class Trojan
Platform IRC
Description

Technical Details

This trojan program consists of two scripts in HTML file.

When an infected HTML page is opened, the VBS part of trojan is written to disk.

The VBS part, in turn, creates another part (INI file), finds and modifies the initialization file of mIRC client, so that it allows mIRC client to respond to remote commands issued by other users, and turns off all Mirc warnings.

Then mIRC is given a special initialization file that allows others to control the infected PC, download and upload files to it, read private messages in Mirc, etc.