Summary

Irok is a virus-worm created by RaiD/SLAM which spreads via IRC and Microsoft Outlook. The worm is 10001 bytes long DOS-based program that is heavily packed and encrypted with a protective envelope that uses anti-debugging tricks.

Additional Details

When run, the worm copies itself to C:\Windows\System\ and C:\Mirc\ folders as IROK.EXE and drops WINRDE.DLL to the \Windows\System\ folder. This file is not a Windows DLL, it is a data file. The worm also replaces SCRIPT.INI file in the C:\Mirc\ folder with its own script that sends the IROK.EXE file to everyone on the IRC channel to which the infected user joins. The worm finally drops a Visual Basic script file IROKRUN.VBS to the Windows Startup directory. This script will be executed next time the system is restarted.

During the next Windows startup, the IROKRUN.VBS script will be executed. It uses Microsoft Outlook to send the worm executable as IROK.EXE to 60 recipients whose addresses are taken from each of Outlook's address books.

The message in which the worm spreads itself looks like this:

 Subject: I thought you might like to see this.

 Body:    I thought you might like this. I got it from paramount pictures
             website. It's a startrek screen saver.

After every message is sent they are removed from the 'Sent Items' folder. Finally the script file is removed from the Windows Startup directory.

At the same time Irok is a non-resident virus, which scans directories listed in PATH= variable for COM and EXE files and then infects them. The virus is a very fast infector. It can infect up to 80 files at a time. The virus is relocating type - it writes itself to the start of the file and relocates the original 10kb of the file to the end. The relocated part is encrypted. Infected files grow 10kb in size.

In some cases the virus can corrupt host programs. The virus has a bug and it does not supply command line options to the host program correctly, so every program that operates with command line parameters will work incorrectly after infection.

The virus avoids infecting files that have extensions and/or their names start with one of the following:

 dll spa man drv scr krnl 386 msc com exp mou gw go sta use gdi con

The virus also deletes the following files:

 anti-vir.dat  chklist.ms  chklist.cps  vs.vsn  ivb.ntz

When internal counters of the virus reach certain values, the virus displays a message on the screen. Most of this message is taken from lyrics of the song 'Aenema' by the band called 'Tool'. We will not reproduce the message here as the song seriously needs the Parental Advisory sticker for explicit lyrics.

The message ends with this text:

        ...
        People cry and people moan. look for a dry place to call their
        own, look for a dry place to rest there bones.

        Thanks for reading the text above, I've had enough time to
        remove the contents of your hard disk for you. :-)

        IRoK v1.1 - RaiD/SLAM[2000]

And indeed, the virus has corrupted files on the hard drive during this event.

The virus also has several internal text strings:

 IRoK v1.1 is initializing... Ok!
 Hey You!  <----------- >>> Push enter stupid!
 RaiD/SLAM[2000]

The Irok virus-worm will not spread itself via Outlook if Windows Scripting Host is not installed on the infected system. The worm will not work if Windows is installed in some other directory than C:\Windows\ and it will not spread itself via IRC if mIRC is installed in a directory other than C:\Mirc\. Regardless of software installed, the worm will infect COM and EXE files on the system it infects.

[Analysis: Katrin Tocheva, Sami Rautiainen and Alexey Podrezov, F-Secure]