Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

Troj/Mirseed-A

Feb 16, 2004 12:49AM PST

Type Trojan

Description
Troj/Mirseed-A is an IRC Trojan that spams IRC channels with the message "[Info] Speed up your mIRC DCC Transfer by up to 75% with DCC Speed-Up Tool, get it now at ww.freewebs.com/mircupdate/mircspeedup.exe -Regards, Network Staff".
The EXE referenced in the URL is Troj/Mirseed-A.

Troj/Mirseed-A copies itself to C:\sysexec.exe and sets the following registry entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
System Root Configuration = C:\sysexec.exe

The Trojan also drops an IRC script into C:\memory.sys that it uses for spamming and logs onto certain predefined IRC channels.

http://www.sophos.com/virusinfo/analyses/trojmirseeda.html

Discussion is locked