Users visit a web page that automatically infects the users just by visiting (javascript enabled). The infection targets mIRC infected users will /msg spam others with a note and the url to the same (or similar) page. Contains this text: 'Hello! wanna see last new Funny Pictures? wanna see last Binladen pic's on year 2002? or the funny sex pictures ,and it's FREE why you are waiting here! visit: http://www.stormpages.com/funnypicz } Please visit our website you can find many funny pictures and movies of SADAM and Bin-laden and Arafaat why you are waiting visit -->http://funnypicz.stormpages.com } Welcome to $chan Please visit our webpage at http://funnypicz.stormpages.com and let me know what you think to it Hi $nick I am an exhibitionist and have just bought a new WebCam. My live Cam feed is at http://www.stormpages.com/funnypicz You can see me squeezing my sweet firm little titties. msg me and tell me what else i can do to make you cum' The infection appears to create multiple files in the c:windowsfontsfonts directory as well as other locations. The infected clients appear to connect to irc server 200.220.31.194:6667 apparently to join the channel #knightz (as noted in the source of the infection).