x
48h OFFER
If you're already a customer of
our homeusers protection,
renew now with a 50% off
RENEW NOW
x
SPECIAL OFFER
If you're already a customer of
our homeusers protection,
renew now with a 50% off
RENEW NOW
x
HALLOWEEN OFFER
take advantage of our
terrific discounts
BUY NOW AND GET A 50% OFF
x
CHRISTMAS OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 40% OFF
x
SPECIAL OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 50% OFF
x
BLACKFRIDAY OFFER
Buy the best antivirus
at the best price
TODAY ONLY UP TO 70% OFF
x
CYBERMONDAY OFFER
Buy the best antivirus
at the best price
(Only for homeusers)
TODAY ONLY UP TO 70% OFF
Active Scan. Scan your PC free
Panda Protection

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

mIRC/Lirva

Threat LevelModerate threatDamageHighDistributionNot widespread
Common name:mIRC/Lirva
Technical name:mIRC/Lirva
Threat level:Low
Type:Worm
Effects:  

It ends processes belonging to antivirus programs and connects to the web site http://www.avril-lavigne.com on the 7th, 11th and 24th of every month.

Affected platforms:

Windows XP/2000/NT/ME/98/95

Detection updated on:Jan. 10, 2003
StatisticsNo

Brief Description 

    

mIRC/Lirva is a dangerous worm that launches the browser Internet Explorer and connects to the website http://www.avril-lavigne.com on the 7th, 11th and 24th of each month.

In addition, mIRC/Lirva ends several processes belonging to antivirus and firewall programs, among others.

mIRC/Lirva spreads through e-mail, the peer to peer (P2P) file sharing program KaZaA, and the chat applications IRC and ICQ.

It is very easy to become affected by mIRC/Lirva via e-mail, as it is automatically activated when the message carrying the worm is viewed through Outlook's Preview Pane. It does this by exploiting a vulnerability in Internet Explorer (versions 5.01 and 5.5), which allows files attached to e-mail messages to be automatically run.

Visible Symptoms 

    

mIRC/Lirva is very easy to recognize, as it launches the browser Internet Explorer and connects to the website http://www.avril-lavigne.com on the 7th, 11th and 24th of each month.

In addition, mIRC/Lirva displays several colored ellipses and the following message on the top left corner of the screen:

"AVRIL_LAVIGNE_LET_GO - MY_MUSE:) 2002 (c) Otto von Gutenberg"