Security Incidents mailing list archives

Re: New piece of spyware?


From: Mister Coffee <live4java () stormcenter net>
Date: Fri, 14 May 2004 08:40:02 -0700

On Fri, May 14, 2004 at 08:11:48AM -0000, caldcv () students fccj org wrote:
In-Reply-To: <20040514020424.22014.qmail () www securityfocus com>

 Sorry I didn't make myself very clear. My machine is sending out the spam. It's mIRC 6.14 - I just use the bare IRC 
client, so I don't think I'm infected via a worm messing with my mIRC files. I looked inside the mIRC folder in all 
of the .ini files and nothing weird appeared. I don't download attachments from unknown sources and only use a few 
websites on a daily basis. 

 Any ideas?

It sounds very much like one of the many mIRC "headline grabber" scripts.  Do you load any scripts at all on client 
startup?  I haven't personally used mIRC in years (XChat or BX depending on situation) but I've seen that behaviour in 
other people's clients.

Cheers,
L4J



---------------------------------------------------------------------------
----------------------------------------------------------------------------


Current thread: