once run, the trojan copies itself to C:\Windows\ using a random file name
It creates a file called profiles.ini in C:\mirc\
Changes mirc.ini to load it the next time mIRC is run.
Profiles.ini replaces these defualt mIRC commands:
/unload, /remove, /remote, /events, /sreq
When you connect to IRC, a notice is sent to #lb_world saying the server the infected person is connected to.
Anyone that joins a channel that the infected person is on will automaticly be sent the trojan.