1/10: VBS/Mcon-G Worm Spreads Via IRC
January 10, 2005

VBS/Mcon-G is a worm that spreads via network shares and IRC channels. When first run the worm copies itself as ttfload.vbs to all folders whose name contains the text string "startup" (without regard for case) and to the Windows fonts folder.

The worm then launches ttfload.vbs from the Windows fonts folder, displays a message box with the text "ERROR", "INVALID FILE FORMAT" and finally deletes itself.

More information can be found at Sophos page.