Lirva

Worm Lirva spreads in the Internet by e-mail, through IRC channels and via file-sharing networks. It installs itself to the computer and terminates most of the known antivirus and security-related processes. Then it starts its spreading routine. It modifies mIRC chat client's settings and spreads using this application. It places infected files to shared directories of popular peer-to-peer clients and tricks other users into downloading and installing these files. However, the worm spreads mostly by e-mail. It uses Microsoft Outlook mail application to distribute infected letters to all the contacts in the Address Book. The worm can steal some of the local passwords and send them to the author. Several times per month Lirva opens a web site and shows an animation.