Aliases: IRC-Worm.Win32.Quin.a, IRC-Worm.Quin.a, W32/Sytro.worm.gen!p2p, Win32.HLLW.Sytro.14, W32/Quin-A
Variants: N/A

Classification: Malware
Category: Computer Worm

Status: Active & Spreading
Spreading: Slow
Geographical info: North America
Removal: Easy
Platform: W32
Discovered: 28 Aug 2002
Damage: Low

Characteristics: W32.Quin.Irc is a worm that spreads through IRC. When run, the worm copies itself as positron.exe. The worm is a slow infector and infects Windows systems. The damage it inflicts on an infected computer is low. It can also be easily removed using an updated antivirus software.

More details about W32.Quin.Irc

The worm W32.Quin, also known as W32.HLLW.Quin, spreads through IRC. When the worm is executed, it copies itself as positron.exe. After that, it queries the registry for the location of mIRC. If mIRC is installed, the worm replaces the Script.ini with a set of instructions to send the EXE file to users who join the same channel as the infected computer. In addition, the Script.ini automatically launches the .exe file in some older versions of mIRC by using an exploit. The infected Script.ini is detected as IRC Family.gen. When the worm has been successfully installed in an infected computer, a message is displayed. The message reads: “Error: QTINTF#.DLL Not Found!”. The display message is an indication that the worm has infected your system. It is recommended that the worm be removed immediately before it does more damage.

The W32.Quin.Irc application downloads and installs other unwanted software. This may include adware programs that display pop-up and pop-under messages. These may appear even if the computer is not connected to the Internet. Spyware applications may also be installed to track browsing habits. These may be used to send more specific advertising.