[cut-n-paste from sophos.com]

Name   W32/Sdbot-BUK

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Modifies data on the computer
    * Deletes files off the computer
    * Steals information
    * Uses its own emailing engine
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Used in DOS attacks
    * Downloads updates
    * Enables remote access
    * Scans network for vulnerabilities
    * Scans network for weak passwords
    * Scans network for open ports

Aliases  
    * WORM_RBOT.GR
    * W32.Linkbot
    * Backdoor.Win32.Rbot.aem

Prevalence (1-5) 2

Description
W32/Sdbot-BUK is a worm for the Windows platform.

W32/Sdbot-BUK spreads
- to computers vulnerable to common exploits, including: LSASS 
(MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049), WebDav (MS03-007), 
Veritas (CAN-2004-1172), Dameware (CAN-2003-1030), PNP (MS05-039) and 
ASN.1 (MS04-007)
- to network shares protected by weak passwords

The worm contains an IRC backdoor component which allows remote 
attackers the ability to gain access and control over the infected 
computer.

Advanced
W32/Sdbot-BUK is a worm for the Windows platform.

W32/Sdbot-BUK spreads
- to computers vulnerable to common exploits, including: LSASS 
(MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049), WebDav (MS03-007), 
Veritas (CAN-2004-1172), Dameware (CAN-2003-1030), PNP (MS05-039) and 
ASN.1 (MS04-007)
- to network shares protected by weak passwords

The worm contains an IRC backdoor component which allows remote 
attackers the ability to gain access and control over the infected 
computer.

When first run, the worm copies itself to the Windows system folder 
using one of the following randomly chosen filenames:

algs.exe
csrs.exe
explorer.exe
firewall.exe
iexplore.exe
Isass.exe
logon.exe
lssas.exe
spooIsv.exe
spoolsvc.exe
winamp.exe
winIogon.exe

The worm creates a registry entry under the following in order to run 
each time a user logs on:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run





Name   W32/Rbot-DZX

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Steals information
    * Downloads code from the internet
    * Records keystrokes
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Used in DOS attacks

Aliases  
    * W32/Sdbot.worm.gen.bp

Prevalence (1-5) 2

Description
W32/Rbot-DZX is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-DZX spreads to other network computers by:

- exploiting common buffer overflow vulnerabilities, including: LSASS 
(MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), 
WebDav (MS03-007), Veritas (CAN-2004-1172), ASN.1 (MS04-007)

- backdoors left behind by the W32/MyDoom and W32/Bagle family of worms

- networks protected by weak passwords

W32/Rbot-DZX runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Rbot-DZX includes functionality to:
- access the internet and communicate with a remote server via HTTP
- record keystrokes
- act as a proxy redirecting internet traffic
- steal CD game keys
- terminate security and anti-virus related processes
- perform DDoS attacks

Advanced
W32/Rbot-DZX is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-DZX spreads to other network computers by:

- exploiting common buffer overflow vulnerabilities, including: LSASS 
(MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), 
WebDav (MS03-007), Veritas (CAN-2004-1172), ASN.1 (MS04-007)

- backdoors left behind by the W32/MyDoom and W32/Bagle family of worms

- networks protected by weak passwords

W32/Rbot-DZX runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Rbot-DZX includes functionality to:
- access the internet and communicate with a remote server via HTTP
- record keystrokes
- act as a proxy redirecting internet traffic
- steal CD game keys
- terminate security and anti-virus related processes
- perform DDoS attacks

When first run W32/Rbot-DZX copies itself to \qopz.exe.

The following registry entries are created to run qopz.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
RPC Service
qopz.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RPC Service
qopz.exe

The following registry entry is set:

HKCU\Software\Microsoft\OLE
RPC Service
qopz.exe





Name   Troj/Mailbot-AJ

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry

Aliases  
    * Trojan-Proxy.Win32.Slaper.c
    * Spam-Mailbot

Prevalence (1-5) 2

Description
Troj/Mailbot-AJ is a Trojan for the Windows platform.

Advanced
Troj/Mailbot-AJ is a Trojan for the Windows platform.

When first run the Trojan copies itself to \mnew6win.exe and 
creates the following file:

\helpermnew6win.exe

The file helpermnew6win.exe is also detected as Troj/Mailbot-AJ.

The Trojan installs itself as a service called "mnew6win".

The following registry entry is created in order to run the Trojan on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
mlrnew6
\mnew6win.exe





Name   W32/Looked-A

Type  
    * Virus

How it spreads  
    * Network shares
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Worm.Win32.Viking.j
    * W32/Gavir.worm
    * Win32/Viking.J
    * W32.Looked.I
    * PE_LOOKED.O-O

Prevalence (1-5) 2

Description
W32/Looked-A is a Windows executable virus and network worm.

The virus infects EXE files found on the infected computer. The virus 
also attempts to copy itself to remote network shares.

Advanced
W32/Looked-A is a Windows executable virus and network worm.

The virus infects EXE files found on the infected computer. The virus 
also attempts to copy itself to remote network shares.

When first run the virus copies itself to \rundl132.exe and creates a file \vDll.dll, 
also detected as W32/Looked-A. This file attempts to download further 
malicious code.

Many files with the name "_desktop.ini" are created, in various 
folders on the infected computer. These files are harmless text files.

The following registry entry is created in order to run the virus on 
startup:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
\rundl132.exe





Name   Troj/WowPWS-K

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Drops more malware
    * Downloads code from the internet
    * Leaves non-infected files on computer
    * Monitors system activity

Aliases  
    * Trojan-PSW.Win32.WOW.r

Prevalence (1-5) 2

Description
Troj/WowPWS-K is a Trojan for the Windows platform.

The Trojan monitors internet activity for traffic to certain online 
gaming servers. Troj/WowPWS-K steals usernames, passwords and other 
transmitted data.

Advanced
Troj/WowPWS-K is a Trojan for the Windows platform.

When run, Troj/WowPWS-K creates the following files:

\Internet Explorer\signup\GServers.inf (data file)
\Internet Explorer\signup\LServers.inf (data file)
\Internet Explorer\signup\foo (data file)
\Internet Explorer\signup\svchost.exe (also detected as 
Troj/WowPWS-K)
\Packet.dll (WinTroj/WowPWS-K is a Trojan for the Windows 
platform.

When run, Troj/WowPWS-K creates the following files:

\Internet Explorer\signup\GServers.inf (data file)
\Internet Explorer\signup\LServers.inf (data file)
\Internet Explorer\signup\foo (data file)
\Internet Explorer\signup\svchost.exe (also detected as 
Troj/WowPWS-K)
\Packet.dll (WinPCap utility)
\WanPacket.dll (WinPCap utility)
\drivers\npf.sys (WinPCap utility)
\wpcap.dll (WinPCap utility)

The Trojan monitors internet activity for traffic to certain online 
gaming servers. Troj/WowPWS-K steals usernames, passwords and other 
transmitted data. PCap utility)
\WanPacket.dll (WinPCap utility)
\drivers\npf.sys (WinPCap utility)
\wpcap.dll (WinPCap utility)

The Trojan monitors internet activity for traffic to certain online 
gaming servers. Troj/WowPWS-K steals usernames, passwords and other 
transmitted data.





Name   Troj/DwnLdr-CJJ

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Trojan-Downloader.Win32.Agent.ams

Prevalence (1-5) 2

Description
Troj/DwnLdr-CJJ is a downloader Trojan for the Windows platform.

Advanced
Troj/DwnLdr-CJJ is a downloader Trojan for the Windows platform.

When first run Troj/DwnLdr-CJJ copies itself to:
<
\.exe

The following registry entries are created to run .exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

\Local Settings\Application Data\.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

\





Name   W32/Zasran-E

Type  
    * Spyware Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Steals information
    * Drops more malware
    * Uses its own emailing engine
    * Reduces system security
    * Installs itself in the Registry

Aliases  
    * Email-Worm.Win32.Banwarum.a
    * W32/Banwarum{at}MM
    * W32.Banwarum{at}mm
    * WORM_RANCHNEG.A

Prevalence (1-5) 2

Description
W32/Zasran-E is a mass mailing worm with backdoor functionality for 
the Windows platform.

W32/Zasran-E runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

W32/Zasran-E is capable of spreading through email. The worm's email 
characteristics may vary.

W32/Zasran-E harvests email addresses from files on the infected 
computer and from the Windows address book.

Advanced
W32/Zasran-E is a mass mailing worm with backdoor functionality for 
the Windows platform.

W32/Zasran-E runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer.

When W32/Zasran-E is installed it creates the file \mszsrn32.dll. This file is also detected as W32/Zasran-E.

W32/Zasran-E injects mszsrn32.dll into the WINLOGON.EXE process and 
creates numerous registry entries under the following entry to run 
the DLL component on startup:

HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\Winlogon\Notify\mszsrn32

W32/Zasran-E is capable of spreading through email. The worm's email 
characteristics may vary.

W32/Zasran-E harvests email addresses from files on the infected 
computer and from the Windows address book.





Name   W32/Sdbot-BUQ

Type  
    * Spyware Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Steals information
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Prevalence (1-5) 2

Description
W32/Sdbot-BUQ is a worm for the Windows platform.

W32/Sdbot-BUQ spreads to other network computers by exploiting the 
buffer overflow vulnerabilities: RPC-DCOM (MS04-012), PNP (MS05-039) 
and ASN.1 (MS04-007) and by copying itself to network shares 
protected by weak passwords.

W32/Sdbot-BUQ runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

Advanced
W32/Sdbot-BUQ is a worm for the Windows platform.

W32/Sdbot-BUQ spreads to other network computers by exploiting the 
buffer overflow vulnerabilities: RPC-DCOM (MS04-012), PNP (MS05-039) 
and ASN.1 (MS04-007) and by copying itself to network shares 
protected by weak passwords.

W32/Sdbot-BUQ runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Sdbot-BUQ copies itself to \Mscfg.exe.

The following registry entries are created to run Mscfg.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Ms System Config
Mscfg.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Ms System Config
Mscfg.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Ms System Config
Mscfg.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Ms System Config
Mscfg.exe

W32/Sdbot-BUQ sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

Note: disabling autostart for the SharedAccess service deactivates 
the Microsoft Internet Connection Firewall (ICF).

Registry entries are set as follows:

HKCU\SYSTEM\CurrentControlSet\Control\Lsa
Ms System Config
Mscfg.exe

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Ms System Config
Mscfg.exe

HKCU\Software\Microsoft\OLE
Ms System Config
Mscfg.exe

HKLM\SOFTWARE\Microsoft\Ole
Ms System Config
Mscfg.exe

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1





Name   Troj/Banloa-ADN

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * Trojan-Downloader.Win32.Banload.ack
    * PWS-Banker.dldr
    * Win32/TrojanDownloader.Banload.ACK

Prevalence (1-5) 2

Description
Troj/Banloa-ADN is a downloading Trojan for the Windows platform.

Troj/Banloa-ADN includes functionality to access the internet and 
communicate with a remote server via HTTP.





Name   Troj/GPCode-A

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Deletes files off the computer
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Aliases  
    * Win32/Gpcode.AD
    * GPcoder.e

Prevalence (1-5) 2

Description
Troj/GPCode-A is a Trojan which encrypts user documents.

Advanced
Troj/GPCode-A is a Trojan which encrypts user documents.

The following registry entry is created to run Troj/GPCode-A on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
services


Registry entries are also created under:

HKCU\Software\Microsoft\Sysinf\

The Trojan searches available drives for files having an extension 
from the following list:

123
akf
c
cvs
dbq
fox
lst
pm4
12m
alv
c??
cwb
dbt
frm
lwp
pm5
3ds
amp
c86
cwk
dbx
frt
lzh
pm6
3dx
ans
cac
cxe
dic
frx
lzs
ppt
4ge
ap
cat
cyp
dif
fsl
lzw
prf
4gl
apa
cbl
d
dm
gtd
ma
prx
a
apo
cc
db
dmd
gz
mak
ps
a86
app
cdb
db0
doc
gzip
man
pst
abc
arc
cdr
db1
dok
h
maq
pw
acd
db2
dox
ha
mar
pwa
ace
arh
cgi
dsc
hh
mbx
pwl
act
arj
dwg
hjt
mdb
pwm
ada
arx
db3
dxf
hog
mdf
pwp
adi
asc
cmd
db4
dxr
htm
mmf
pxl
aex
ask
cnt
dba
eps
html
mo
rar
af3
bb
cob
dbb
exp
htx
myd
rle
afd
bcp
col
dbc
f
ice
old
rmr
ag4
bdb
cpp
dbd
fas
icf
p12
rnd
ai
bh
cpt
dbe
fax
ihtml
pak
rtf
aif
bib
crp
dbf
fdb
pdf
safe
aifc
bsa
cru
fla
ish
pem
sar
aiff
btr
csc
jar
pfx
sig
ain
bup
css
dbk
flb
jsp
pgp
sln
aio
bwb
csv
dbm
key
pl
swf
ais
bz
ctx
dbo
fm
kwm
pm3
tar
tbb
tex
tga
txt
vp
xcr
xls
xml
zip
zoo

The Trojan will then encrypt any matching files. In every folder in 
which files have been encrypted, Troj/GPCode-A creates a file named 
"readme.txt" containing the following message:

Some files are coded by RSA method.
To buy decode mail: k{at}mail.ru
with subject: REPLY

(where  is a decimal number)

The Trojan also creates the file autosave.sin in the user's temporary 
folder. This file contains a list of all files which the Trojan has 
scanned during encryption.





Name   W32/Tilebot-FD

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Drops more malware
    * Downloads code from the internet
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities
    * Used in DOS attacks

Aliases  
    * WORM_SDBOT.IL
    * Backdoor.Win32.SdBot.xd

Prevalence (1-5) 2

Description
W32/Tilebot-FD is a worm and IRC backdoor Trojan for the Windows 
platform.

Advanced
W32/Tilebot-FD is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Tilebot-FD spreads to other network computers by exploiting 
common buffer overflow vulnerabilities, including: LSASS (MS04-011), 
RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039) 
and ASN.1 (MS04-007) and by copying itself to network shares 
protected by weak passwords.

W32/Tilebot-FD runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

W32/Tilebot-FD includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Tilebot-FD copies itself to \smss.exe.

The file \smss.exe is registered as a new system driver 
service named "Aol Software", with a display name of "aol
software" 
and a startup type of automatic, so that it is started automatically 
during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Aol Software\

W32/Tilebot-FD sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

Registry entries are created under:

HKCR\.key\
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\





Name   Troj/Backdr-C

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer

Aliases  
    * BKDR_TINYDOG.C
    * Backdoor.Win32.Shell.b

Prevalence (1-5) 2

Description
Troj/Backdr-C is a backdoor Trojan for the Windows platform.

Troj/Backdr-C allows a remote intruder access to the infected computer.





Name   Troj/Banloa-AFG

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * Trojan-Downloader.Win32.Banload.atn
    * PWS-Banker.gen.i

Prevalence (1-5) 2

Description
Troj/Banloa-AFG is a Trojan for the Windows platform.

Troj/Banloa-AFG includes functionality to access the internet and 
download further malicious code.





Name   Troj/Banker-BWC

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals credit card details
    * Steals information
    * Uses its own emailing engine
    * Installs itself in the Registry

Aliases  
    * Trojan-Spy.Win32.Banker.anv
    * W32/Banker.RQK
    * PWS-Banker.gen.bb
    * Infostealer.Bancos
    * TSPY_BANKER.EGM

Prevalence (1-5) 2

Description
Troj/Banker-BWC is a password-stealing Trojan for the Windows platform.

Advanced
Troj/Banker-BWC is a password-stealing Trojan for the Windows platform.

Troj/Banker-BWC includes functionality to send notification messages 
to remote locations.

The Trojan monitors browser activity for access to specific internet 
banking websites. When one of these sites is visited, the Trojan 
displays a fake login interface in order to capture the user's 
account details.

When first run Troj/Banker-BWC copies itself to:

\lsass32.exe
\lsass32.exe

The following registry entry is created to run lsass32.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
lsass32
\lsass32.exe





Name   Troj/Zlob-MW

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs itself in the Registry

Aliases  
    * Trojan-Downloader.Win32.Zlob.rw
    * Win32/TrojanDownloader.Zlob.PZ

Prevalence (1-5) 2

Description
Troj/Zlob-MW is a Trojan for the Windows platform.

Advanced
Troj/Zlob-MW is a Trojan for the Windows platform.

When Troj/Zlob-MW is installed the following files are created:

\Media-Codec\ecodec.exe
\Media-Codec\uninst.exe
\regperf.exe
\ld.tmp
\nsa4.tmp\Loader.dll

for some randomly generated number . The files ecodec.exe, 
regperf.exe, Loader.dll and ld.tmp are also detected as 
Troj/Zlob-MW.

The following registry entry is created to run regperf.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
wininet.dll
regperf.exe

Registry entries are created under:

HKCR\EMediaCodec.Chl\CLSID\
HKCR\Media-Codec.Chl\CLSID\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Media-Codec\





Name   Troj/Zapchas-BL

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Drops more malware
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Prevalence (1-5) 2

Description
Troj/Zapchas-BL is a multi-component backdoor Trojan for the Windows 
platform.

Troj/Zapchas-BL drops the virus W32/Parite-B.

Advanced
Troj/Zapchas-BL is a multi-component backdoor Trojan for the Windows 
platform.

When Troj/Zapchas-BL is installed the following files are created:

\You Have Been HaCkeD By Me.jpg
\aliases.ini
\control.ini
\fullname.txt
\ident.txt
\mirc.ico
\mirc.ini
\nicks.txt
\popups.txt
\remote.ini
\script.ini
\servers.ini
\sup.bat
\sup.reg
\svchost.exe
\users.ini
\yaddress.ico

The files mirc.ini anc script.ini are also detected as 
Troj/Zapchas-BL. The file svchost.exe is a mIRC chat application, 
infected with W32/Parite-B. The other files are harmless and may be 
deleted.

The following registry entries are set or modified, so that 
svchost.exe is run when files with extensions of CHA and IRC are 
opened/launched:

HKCR\ChatFile\Shell\open\command
(default)
\svchost.exe" -noconnect

HKCR\irc\Shell\open\command
(default)
\svchost.exe" -noconnect

Registry entries are set as follows:

HKCR\ChatFile\DefaultIcon
(default)
\svchost.exe

HKCR\irc\DefaultIcon
(default)
\svchost.exe

Registry entries are created under:

HKCU\Software\Microsoft\Microsoft Agent\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC\

 
--- MultiMail/Win32 v0.43