Fandom

Malware Wiki

Fagot

1,327pages on
this wiki
Add New Page
Comment1 Share

IRC-Worm.Win32.Fagot or Fagot is a worm that runs on Internet Relay Chat (IRC) program with Windows 32-bit OS that can give you multiple Blue Screen Of Deaths.

BehaviorEdit

This virus would spread over IRC, however this routine has long since stopped working since the worm originally downloaded this file from a server that has been deleted. This would just be the end result of an infection prior to the worm spamming itself to every IRC channel it could find.

Payload(s)Edit

When the user runs the program, usually when they receive the file through IRC, it will pop up many errors. Including:

  • svchost.exe crashing claiming memory could not be written with the instructions deriving from thread 0x71a64618
  • A Windows Protection Error, indicating that multiple critical files have been overwritten
  • Finally, an error in memory block #A5487F (This message is a fake error put out by the worm.)

These errors are all caused by the fact that critical processes have been overwritten with irrelevant data. If the user now checks the file attributes, they will discover that the file sizes have decreased drastically. If the user tries to run programs, the worm will hide the file and not allow you to run said application.

Upon restarting, files that is compromised included the startup ones, and the computer will fail to boot.

On Windows 9x, it will still boot, but prompt the user to reinstall Windows. However, reinstalling simply results in multiple errors, and the user will not be able to start, as setup causes multiple Blue Screens. This will require the user to format and reinstall if this occurs.

VideosEdit

IRC-Worm.Win3209:10

IRC-Worm.Win32.Fagot

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.