Irok trojan is a DOS based trojan. This trojan affects Windows 98 systems. It will infect Windows 95 system only if Windows scripting host is enabled. This trojan is spreading through IRC (Internet Relay Chat). It also behaves like a worm by sending emails from the infected system without user's knowledge.

When the infected file is run, it copies itself as irok.exe under Windows\System directory. It also creates a visual basic script, irokrun.vbs, under Startup directroy of Windows. At the next boot, using this script it tries to send the emails to the addresses found in the Outlook Express address book. It sends email with the following subject

I thought you might like to see this.

The body of the message will be

I thought you might like this. I got it from paramount pictures website. It's a startrek screen saver.

This email carries an attachment called irok.exe, which is infected by Irok trojan.

The viral part of the trojan infects all types of executable files. It overwrites the content of the executable files, thereby making vaccination impossible.

Irok first appeared in March 2000.

Other names of Irok trojan:

This trojan is also known as VBS/Irok.

Removing Irok from your computer:

You can remove this trojan from your computer by using Protector Plus antivirus software.