Help - Search - Members - Calendar
Full Version: W32/IRCbot.worm!MS05-039
Unexplained Mysteries Discussion Forums > Other > Computers, Gaming & The Internet > Computing Help and Support
Daughter of the Nine Moons
Got hit with this real bad at work!
Source: McAfee
Virus Summary
Virus Name - W32/IRCbot.worm!MS05-039
Risk Assessment Corporate User : High Home User : High

Virus Information
Discovery Date: 08/16/2005
Origin: Unknown
Length: 10366 bytes
Type: Virus
SubType: Internet Relay Chat
Minimum DAT: 4560 (08/16/2005)
Updated DAT: 4560 (08/16/2005)
Minimum Engine: 4.4.00
Description Added: 08/16/2005
Description Updated: 08/16/2005 7:10 PM (PT)

Virus Characteristics
This detection is for an Internet Relay Chat (IRC) bot worm which includes the ability to spread by exploiting systems which are not yet patched for the MS05-039 vulnerability .

This worm is designed to contact a remote IRC server and wait for further instructions.

If you think that you may be infected with W32/IRCbot.worm!MS05-039, and are unsure how to check your system, you may download the Stinger tool to scan your system and remove the virus if present. This is not required for McAfee users as McAfee products are capable of detecting and removing the virus with the latest update. (see the removal instructions below for more information).

Installation

When the file is run the virus copies itself to the Windows System directory (e.g. C:\Windows\System32\ on Windows XP) as WINTBP.EXE. The file can be run automatically by exploiting the MS05-039 vulnerability or by a person directly executing the worm.

Registry keys are created to load the worm at startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "wintbp.exe" = wintbp.exe


Symptoms
If this worm is run on a system which has not yet been patched for the MS05-039 vulnerability, it will continually reboot.


Method Of Infection
This threat scans for MS05-039 exploitable systems. When a vulnerable system is found, it uses a buffer overflow to write the worm file to that machine via a TFTP upload on port 8594. Blocking this port via McAfee Desktop Firewall or McAfee Personal Firewall will prevent infection even if the buffer overflow is not prevented.


Skuzzlebutt
I have read about a new virus out there...let me give you some good advice for a virus protection program...

First I will tell you I have been building computers since 1985 and I went to college and earned an associate degree in computers. I have tried all the antivirus programs there are and in my experience I will give you the best one....

I have been using this one since 1998..... it is made by a german guy and is free for now....he finally made it big and this program you will have to pay for very soon...it is called Antivir6

Go here to download it. It is the only one I use on my computers and the only one I use to to do repairs. Good luck....

www.free-av.com
Discordia
Usually getting viruses from IRC means that you are using a script, Here's a pointer about Scripts. Using DCC's on IRC isn't exactly a good idea, there are a lot of exploits. Ranging from exploits that make a person's irc crash to sending you viruses via DDC. If using script I would suggest that you ignore all DCC's. Just go into IRC options> DCC and Ignore all then press ok.

Here's something to try to show you how a person can exploit you via script. Open up a new alias and copy this into it, after copying press okay.
/crash { .raw PRIVMSG $1 $+(:,$chr(1),DCC) send " $+ $str($rand(a,z) $+ $chr(32),250) $+ " 0 2130706433 $+(8192,$chr(1)) }

The only thing that this does is crash someone's script, in no way does it harm anything. Ask someone you know that doesn't have their DCC's blocked if you can crash their script. Type /crash nickname and it will disconnect them from the server they are on. If you get someone who is really good at scripting they can program some really nasty stuff, it's sad but true.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2008 Invision Power Services, Inc.