The Web    Google
1/10: VBS/Mcon-G Worm Spreads Via IRC

1/10: VBS/Mcon-G Worm Spreads Via IRC
January 10, 2005

VBS/Mcon-G is a worm that spreads via network shares and IRC channels. When first run the worm copies itself as ttfload.vbs to all folders whose name contains the text string "startup" (without regard for case) and to the Windows fonts folder.

The worm then launches ttfload.vbs from the Windows fonts folder, displays a message box with the text "ERROR", "INVALID FILE FORMAT" and finally deletes itself.

More information can be found at Sophos page.

  • Critical Flaws Flagged in Mozilla, Thunderbird
  • 2/7: Agobot-PI Worm Changes Data
  • Gentoo 2005.0 All About Security
  • ActivCard Enhances Authentication for Remote Access Over Web
  • 2/23: Anicmoo-B a Downloader Trojan
  • The Worm That Won't Go Away
  • Outtasking Solution to Company's Email Woes
  • 1/12: Mugly-D Worm Drops IRC Backdoor
  • CERT, ArcSight Partner With 3 Universities On Security Sharing
  • 1/11: Agobot-OV Worm Connects to IRC Server
  • Report: CEOs Stagnant on Security
  • Discussion on Security Camera