This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
4114 (2001-01-03)Updated DAT
When this Visual Basic Script virus is executed, it will modify the "C:\MIRC\SCRIPT.INI" file to instruct mIRC to distribute the worm to others when connecting to a chat room. However, the file specified,
"CounterstrikeRP.TXT .vbs" (in the "C:\WINDOWS\SYSTEM" directory)is not created by the actions of this worm and therefore this action will fail. When an infected user quits the mIRC program, a message is displayed:
Accidentally or intentionally running this script infects your machine.
The worm copies itself to "c:\WINDOWS\system\RP.TXT.vbs", and "c:\WINDOWS\Start Menu\Programs\StartUp\Startup.vbs"
If the day of the month is 1,5,10,15,20, or 25 the script creates a bitmap image. This is accomplished by creating the files, "C:\WINDOWS\RP.DLL", and "C:\WINDOWS\WINSTART.BAT". The batch file is used to convert the RP.DLL file to RP.BMP. The Wallpaper is then set to "C:\WINDOWS\CounterstrikeRP.BMP", which does not exist.