W32/IRCBot.ET is a worm. The worm will infect Windows 2000 systems which are not updated with MS05-039 vulnerability patch released by Microsoft. The worm cannot infect Windows Me/98/95/XP/NT computers until and unless the infected file is executed manually in the local computer.

This worm exploits PnP vulnerability present in Windows as explained by Microsoft Security Bulletin MS05-039.

Upon execution, the worm copies itself as windrg32.exe in the Windows system folder.
It alters the windows registry at the following location to load itself during next startup;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The worm also creates ftp server and randomly scans for the computers with this flaw on the network. If found then the worm creates a remote access through TCP 445 and sends a script file to the victim computer. This script file will download a copy of worm from the infected computer and executes the same in the victim's computer.

Microsoft has released the patch for the MS05-039 vulnerability. It can be downloaded from the following link:

http://www.microsoft.com/technet/security/bulletin/MS05-039.mspx

Users should apply the patch downloaded from the link provided above to remove the vulnerability inherent in the system.

This worm first appeared on August 16, 2005.

 Other names of W32/IRCBot.ET Worm:

This Worm is also known as WORM_DRUDGEBOT.A.