Home Malware Programs Worms Mircnuf

Mircnuf

Posted: March 28, 2006

Mircnuf is an Internet worm that spreads through IRC chat networks. The spyware distributes an executable file that pretends to be a serial key generator for a popular PC game, usually Quake 4. Once the user executes this file, the worm secretly installs itself to the computer and runs a payload. It modifies default settings of mIRC chat application and overwrites Windows essential configuration file win.ini. Mircnuf automatically runs on every computer startup.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 q4keygen.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunvwin=%Windows%q4keygen.exeHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunvwin=%Windows%q4keygen.exe
Loading...