SCRIPT.INI

SCRIPT.INI is a file that mIRC looks for and runs. If you accept the DCC and save it to the mIRC directory, any code sent in SCRIPT.INI is executed. If you do not accept the DCC transfer it will not be able to run.

You should upgrade to the latest version of mIRC because it makes it harder for someone to plant a SCRIPT.INI without your knowledge. Unfortunately, it does not always get rid of an existing infection. To get rid of the SCRIPT.INI virus under Windows 95/98:

Close mIRC if it is open.
Navigate to your Mirc folder.
Choose Folder Options from the View menu, click the View tab, then click "Show all files".
Find SCRIPT.INI and drag it to the recycle bin.

That's it! Some sites give you a whole song and dance of different commands to type in, but it's not as simple or as secure as deleting the file yourself.

You should also never accept DCCs that you didn't request.

Please e-mail me if you have any questions, suggestions, or comments.

So far, there are at least 100 script viruses/worms not counting Dmsetup. Dmsetup worms have an EXE or COM or ".jpg.com" extension and are described here They are viruses because the only requirement in the definition of a virus is that it replicates. The names are based on Findvirus names. The first part of the name is the platform(IRC) the second refers to a prominent identifying text string or behaviour in the script. The third part refers to the size in bytes. If more than one are the same size, they are lettered A,B,C...

IRC/Acoragil.1536 If someone types "Acoragil" in the channel, it quits. If someone types "shirak" in the channel, it sends "c:\win95\system.cb" If someone types "Durak" in the channel, it turns "c:\mirc" into an fserve. If someone types "shirac" in the channel, it sends "c:\linux\etc\passwd." If someone types "shirat" in the channel it sends "c:\unix\etc\passwd." It sends actions to the channel #x3212. It sends SCRIPT.INI and says "Hello there" when the user joins the channel. It tries to protect certain users.
IRC/Acoragil.2048 If someone types "Acoragil" in the channel, it quits. If someone types "shirak" in the channel, it sends "c:\win95\system.cb" If someone types "Durak" in the channel, it turns "c:\mirc" into an fserve. If someone types "shirac" in the channel, it sends "c:\linux\etc\passwd." If someone types "shirat" in the channel it sends "c:\unix\etc\passwd." It sends actions to the channel #x3212. It sends SCRIPT.INI and when the user joins the channel. It tries to protect certain users.
IRC/Acoragil.2764 If someone types "Acoragil" in the channel, it quits. If someone types "shirak" in the channel, it sends "c:\win95\system.cb" If someone types "Durak" in the channel, it turns "c:\mirc" into an fserve. If someone types "shirac" in the channel, it sends "c:\linux\etc\passwd." If someone types "shirat" in the channel it sends "c:\unix\etc\passwd." It sends actions to the channel #x3212. It sends SCRIPT.INI and when the user joins the channel. It tries to protect certain users.
IRC/Acoragil.3102 If someone types "Er0lsux" it quits with the message "I was boffed at http://bsf.home.ml.org/" If someone types "SuckMe" it turns "c:\" into an fserve If someone says "hi" it says "Maybe I Should Go To http://bsf.home.ml.org/ cause it rocks the world." It sends script.ini on entering and leaving. It tries to protect some users
IRC/Acoragil.3204 If someone types "Acoragil" in the channel, it quits. If someone types "shirak" in the channel, it sends "c:\win95\system.cb" If someone types "Durak" in the channel, it turns "c:\mirc" into an fserve. If someone types "shirac" in the channel, it sends "c:\linux\etc\passwd." If someone types "shirat" in the channel it sends "c:\unix\etc\passwd." It sends actions to the channel #x3212. It sends SCRIPT.INI and when the user joins the channel. It tries to protect certain users.
IRC/Acoragil.3251 If someone types "Er0lsux" it quits with the message "I was boffed at http://bsf.home.ml.org/" If someone types "SuckMe" it turns "c:\" into an fserve. If someone says "hi" it says "Maybe I Should Go To http://bsf.home.ml.org/ cause it rocks the world." It sends script.ini on entering and leaving. It tries to protect some users On connection it sends "online" to twi|ight`. If someone types "Bas3ball" it ops them. If someone types "t3st" sends Twi|ight` "i'm fucked"
IRC/Acoragil.3971 If someone types "Acoragil" in the channel, it quits. If someone types "shirak" in the channel, it sends "c:\win95\system.cb" If someone types "Durak" in the channel, it turns "c:\mirc" into an fserve. If someone types "shirac" in the channel, it sends "c:\linux\etc\passwd." If someone types "shirat" in the channel it sends "c:\unix\etc\passwd." It sends actions to the channel #x3212. It sends SCRIPT.INI and when the user joins the channel. It tries to protect certain users.
IRC/Cure.904 It contains the text: "THE CURE FOR THE BAD " SCRIPT.INI " INFECTION" It sends script.ini on entering. If someone types "ïëñshutdown" in the channel it sends the message "U Are Just Another FuckUp Lamer" If someone types "SCRIPT.INI" in the channel it sends the message "Here the cure for script.ini infection" If someone types "Ä|ïëñrú|ê><" in the channel it ops them and sends the message "A BIG FUCK YOU TO YOU, LAMER"
IRC/Diversao.782 It sends "diversao.ini" and the message:
```
Oie! Ei to mandando esse script q é só diversão!!!  ;)
ó, pra ativar ele escreva: /load -rs diversao.ini
vich.. tenho q ir! tchau! :*************************
```
Then ignores the person it was sent to. It contains the hidden word "TRASH" If the word "ala" is type in the channel, it displays the message "HERE" If the text "pinger" is in a CTCP it sends parameters two onwards(?)
IRC/Diversao.831 It sends "diversao.ini" when a user enters the channel and the message:
```
Oie! Ei to mandando esse script q é só diversão!!!  ;)
ó, pra ativar ele escreva: /load -rs diversao.ini
vich.. tenho q ir! tchau! :*************************
```
Then ignores the person it was sent to. It contains the hidden word "TRASH" If the word "TRASH" is type in the channel, it displays the message "HERE" If the text "pinger" is in a CTCP it sends parameters two onwards(?)
IRC/Dmsetup Dmsetup worms have moved here
IRC/Fono.428 This is the script.ini dropped by the Win95/Fono (a.k.a. El_Inca) virus. It runs the Inca.exe file, which is infected with the Win95/Fono virus. It sends script.ini and inca.exe when users enter or leave the channel. If someone types "el_inca" in the channel, it runs revenge.com, which erases the CMOS. If someone types "ancev" in the channel, it turns "c:\mirc" into an fserve. If someone types "_29A_" in the channel, it quits.
IRC/Gakk.330 If someone types "gakk-q" it quits. If someone types "gakk-f" it turns "c:\" into an fserve If someone says "hi" it says "Maybe I Should Go To http://bsf.home.ml.org/ cause it rocks the world." It sends script.ini on leaving. It spies on conversations.
IRC/Gakk.479 If someone types "gakk-q" it quits. If someone types "gakk-f" it turns "c:\" into an fserve If someone says "hi" it says "Maybe I Should Go To http://bsf.home.ml.org/ cause it rocks the world." It sends script.ini on leaving. It spies on conversations. It contains the text "Protection List"
IRC/Hamster.19176 This one is about 20 times more complex than the average script virus. I have not completed analysis.
IRC/Jeepwarz.1024.A This variant is truncated. When mIRC is started it sends #jeepwarz "Hi. [ip] on [server]"
IRC/Jeepwarz.1024.B It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. When mIRC is started it sends #jeepwarz "Hi. [ip] on [server]"
IRC/Jeepwarz.1033 It sends when the user enters the channel. If someone types "gib op" in the channel, it tries to op cameron. It tries to unban itself if it is banned but still opped. It tries to determine if it is being followed.
IRC/Jeepwarz.1441 When mIRC starts, it says "script.ini patch installed!" If someone tries to send script.ini it says "WARNING!!! $nick HAS SENT YOU script.ini!!!" "PLEASE NOTIFY THEM THAT THEY ARE INFECTED" It sends conversations to #clikk If someone says "XX!XX" it says to them "I am NOT infected! I'm protected by script.ini protector!" It sends when the user enters the channel along with the message "Please accept he file script.ini! It is a PATCH against the other nasty script.ini files"
IRC/Jeepwarz.1538 It contains the text: "HI EVERYBODY DCC ME 12/F" It sends when the user enters the channel. When mIRC is started it sends #jeepwarz "Hi. [ip] on [server]" It tries to determine if it is being followed. It spies on conversation sending to #jeepwarz.
IRC/Jeepwarz.2560 This variant is truncated. It tries to determine if it is being followed. When mIRC is started it sends #jeepwarz "Hi. [ip] on [server]"
IRC/Jeepwarz.2972 It contains the text: "HI EVERYBODY DCC ME 12/F" It sends when the user enters the channel. When mIRC is started it sends #jeepwarz "Hi. [ip] on [server]" It tries to determine if it is being followed.
IRC/Jeepwarz.3072.A It sends when the user enters the channel. It tries to take over the channel. When mIRC is started it sends #jeepwarz "Hi. [ip] on [server]" It tries to determine if it is being followed.
IRC/Jeepwarz.3072.B It sends when the user enters the channel. It tries to take over the channel. When mIRC is started it sends #jeepwarz "Hi. [ip] on [server]" It tries to determine if it is being followed.
IRC/Jeepwarz.3160.A It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and tries to protect some users. It sends conversations to #x3212
IRC/Jeepwarz.3160.B It tries to determine if it is being followed. It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. When mIRC is started it sends #jeepwarz "Hi. [ip] on [server]" With a one in 100 chance it ops someon, ops them, sends script.ini and says "--==i'M_T00_C00l!==--"
IRC/Jeepwarz.3160.C It sends when the user enters the channel. It tries to take over the channel. When mIRC is started it sends #jeepwarz "Hi. [ip] on [server]" It tries to determine if it is being followed.
IRC/Jeepwarz.3164 It sends when the user enters the channel. It tries to take over the channel. When mIRC is started it sends #spellcaster "Hi. [ip] on [server]" It tries to determine if it is being followed. It tries to unban itself if it is banned but still opped.
IRC/Jeepwarz.3165 It sends when the user enters the channel. It tries to take over the channel. When mIRC is started it sends #jeepwarz "Hi. [ip] on [server]" It tries to determine if it is being followed.
IRC/Jeepwarz.3720 It sends when the user enters the channel. It tries to take over the channel. When mIRC is started it sends #jeepwarz "Hi. [ip] on [server]" It tries to determine if it is being followed. If someone mentions SCRIPT.INI it leaves the channel.
IRC/Panterax.387 Any input in sent to #coolz. It sends when joining the channel. On connecting, it sends #coolz "Oi. meu [ip] no [server]:[port]. If someone sends runthis in a private message, it runs it.
IRC/Panterax.388 Any input in sent to #whacked. It sends when joining the channel. On connecting, it sends #whacked "Oi. meu [ip] no [server]:[port]. If someone sends runthis in a private message, it runs it.
IRC/Panterax.396 If someone types "@@@" it ops them. If someone types "×com" it quits. If someone types 123456789 it send the message "Im a lamah". Any private conversation in sent to aaay. It sends when leaving the channel after a delay of 5 seconds.
IRC/Panterax.512 Any input in sent to #whacked. It sends when joining the channel. On connecting, it sends #whacked "Oi. meu [ip] no [server]:[port]. If someone sends runthis in a private message, it runs it.
IRC/Panterax.1355 If someone types "panterax" it ops them. If someone types x123456789 it sends the message "Im a lamah". If someone types "mowgli" in the channel, it turns "c:\mirc" into an fserve. Any private conversation in sent to aaay and centrall. It sends to every tenth person. If someone types "critter" it invites them to a channel. If someone types "pighouse" it quits. If someone types "toolworks" it does whatever comes after it.
IRC/Panterax.1588 If someone types "panterax" it ops them. If someone types x123456789 it sends the message "Im a lamah". If someone types "mowgli" in the channel, it turns "c:\mirc" into an fserve. Any private conversation in sent to aaay and centrall. It sends to every tenth person. If someone types "critter" it invites them to a channel. If someone types "pighouse" it quits. If someone types "toolworks" it does whatever comes after it. It sends when leaving the channel after a delay of 5 seconds.
IRC/Remini.2035 It removes several sections from C:\windows\win.ini and C:\windows\system.ini It contains the text "your fucked" and "bow down, nigga" It sends script.ini on entering and leaving.
IRC/Repro.512 It sends script.ini on entering and leaving. It contains the text "Reproduction v1.0" It sends conversations to #RePro.
IRC/Shorty.185 If someone types "!destroy" it quits with the message "have to go now cya" It sends script.ini on entering.
IRC/Simpsalapim.261 It sends when the user enters or leaves the channel. If someone types "Hasta" in the channel, it quits with the message "In Place" If someone types "Testing" in the channel it sends the message "In Place"
IRC/Simpsalapim.395 It sends when the user enters or leaves the channel. If the user, says anything, does anything, or quits it will send the message "Why am I a bad boy." to the channel.
IRC/Simpsalapim.512.A It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel, but this variant is truncated.
IRC/Simpsalapim.512.B It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel, but this variant is truncated.
IRC/Simpsalapim.512.C It sends when the user enters or leaves the channel. This variant is truncated.
IRC/Simpsalapim.553 It sends when the user enters or leaves the channel. If the user, says anything, does anything, or quits it will send the message "Why am I a bad boy." to the channel. It fakes the unload command. If someone types "opie" it turns c:\mirc into an fserve.
IRC/Simpsalapim.597 It sends when the user enters or leaves the channel. If someone types "bruham" in the channel, it quits with the message "brUHaM k EnA grDa zhWaU nagRauZHna!!!" If someone types "br!am" in the channel it sends the message "brUHaM!!!!" If someone types "brooham" in the channel changes the nick to several different nicks.
IRC/Simpsalapim.780 It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel, but this variant is truncated.
IRC/Simpsalapim.912 It sends when the user enters or leaves the channel. If someone types "brb" in the channel, it quits with the message "blowjobs starting at 1.99!" If someone types "hello" in the channel it sends the message "hello [nick], if your gay message me!" If someone types "lol" in the channel it sends the message "haha really funny [nick], your such a dumbass" If someone types "dick" in the channel it sends the message "i love dick, [nick]" If someone types "msg me" in the channel it sends the message "hi studmuffin, i'm gay!!!!" If someone types "welcome" in the channel it sends the message "fuck you man im not welcome, [nick]" If someone types "help" in the channel it sends the message "if you need help bend over and grab the soap, [nick]" If someone types "need a script" in the channel it sends them script.ini
IRC/Simpsalapim.1024.A It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel, but this variant is truncated.
IRC/Simpsalapim.1024.B It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel, but this variant is truncated.
IRC/Simpsalapim.1042 It sends when the user enters or leaves the channel. If someone types "lord" in the channel, it ops them. If someone types "biguy" in the channel it tries to register them as an op. If someone types "master" in the channel it tries to register them as super op (?). If someone types "crazy" in says:
```
come to #camelot it's the best channel
plz come they will give me op
plz come
 
dear ops
don't kick me plz
maybe u can made me sop
```
If someone types "lehit" in the channel it quits saying "I'm little crazzzzzzzzy" If someone types "sote" in the channel it sends to the channel the message "I wanna fuck you all girls" If someone types "cici" in the channel it sends to the channel the message "so what so I'm gay i'm not the only one" If someone types "mihata" in the channel it sends them the message "I'm little crazzzzzzzzy" If someone types "loveme" in the channel it sends them the message "hi wassup?" If someone types "hot" in the channel it sends them the message "I want U now"
IRC/Simpsalapim.1092 It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and sends the message "--==i'M T00 C00l!==--" to the channel.
IRC/Simpsalapim.1129.A It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and sends the message "--==i'M T00 C00l!==--" to the channel.
IRC/Simpsalapim.1129.B It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and sends the message "--==i'M T00 C00l!==--" to the channel.
IRC/Simpsalapim.1129.C It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and sends the message "--==i'M T00 C00l!==--" to the channel.
IRC/Simpsalapim.1129.D It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and sends the message "--==i'M T00 C00l!==--" to the channel.
IRC/Simpsalapim.1150 It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and sends the message "--==i'M T00 C00l!==--" to the channel.
IRC/Simpsalapim.1172 It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and sends the message "--==i'M T00 C00l!==--" to the channel.
IRC/Simpsalapim.1174.A It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and sends the message "--==i'M T00 C00l!==--" to the channel.
IRC/Simpsalapim.1174.B It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and sends the message "--==i'M T00 C00l!==--" to the channel.
IRC/Simpsalapim.1174.C It sends when the user enters the channel. If "WiLd-FiRe" enters the channel, it halts. It tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and sends the message "--==i'M_T00_C00l!==--" to the channel. On connect it sends "WiLd-FiRe" the message "Hi I am [name] on server [server] in port [port]"
IRC/Simpsalapim.1174.D It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and sends the message "--==i'M T00 C00l!==--" to the channel.
IRC/Simpsalapim.1329 It sends when the user enters or leaves the channel. If someone types "anyone in here" in the channel, it quits with the message "This New version is alittle different!BaCKD00R 1.1" If someone types "tell me" in the channel it sends the message "This New version is alittle different!BaCKD00R 1.1" If someone types "give it up" in the channel changes the nick to "_XInFected" and tries to take over the channel. I someone types "send me" it sends script.ini. I someone type "deathishere" it sets the variable "death" to on. If death is on when it connects, it quits with the message "BaCKD00R Bitches It Rules"
IRC/Simpsalapim.1436 It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and tries to protect some users, but this variant is truncated.
IRC/Simpsalapim.1536.A It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and tries to protect some users, but this variant is truncated.
IRC/Simpsalapim.1536.B It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and tries to protect some users, but this variant is truncated. It sends conversations to #x3212
IRC/Simpsalapim.1536.C It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and tries to protect some users, but this variant is truncated.
IRC/Simpsalapim.1536.D It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and tries to protect some users, but this variant is truncated. It sends conversations to #x3212
IRC/Simpsalapim.1536.E It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and tries to protect some users, but this variant is truncated.
IRC/Simpsalapim.1889 It sends when the user enters or leaves the channel. If someone types "eyebrow" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "bananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and tries to protect some users.
IRC/Simpsalapim.2048.A It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and tries to protect some users, but this variant is truncated.
IRC/Simpsalapim.2048.B It sends when the user enters, leaves, changes nicks, says script.ini, or is opped in the channel. If someone types "simpsalapim" in the channel, it sends script.ini If someone types "XX!XX" in the channel it sends sends script.ini amd the message "i'm iNFeCTeD!" If someone types "ananas" in the channel it sends the message "i'm iNFeCTeD!", changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 50 chance it ops someone and sends script.ini and tries to protect some users, but this variant is truncated. It contains the text: "Created by dAxis and PhatBlunt. Nuf Said." If someone is kicked, it sends script.ini and sends the message "i'm iNFeCTeD!" With a 1 in 30 chance it ops someone and sends script.ini and sends the message "xx!xx" to the channel. When script.ini is finished it sends #yuckfou "Script.ini successfully sent to [name]" If someone says "hotdiggity" it turns c:\ into an fserve.
IRC/Simpsalapim.2048.C It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and tries to protect some users, but this variant is truncated.
IRC/Simpsalapim.2048.D It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and tries to protect some users, but this variant is truncated.
IRC/Simpsalapim.2048.E It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and tries to protect some users, but this variant is truncated.
IRC/Simpsalapim.2560 It sends when the user enters or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. It tries to protect some users, but this variant is truncated.
IRC/Simpsalapim.2868 This is two other Simpsalapims truncated and joined together. It sends when the user enters, or leaves the channel. If someone types "simpsalapim" in the channel, it quits with the message "iNFeCTeD!" If someone types "XX!XX" in the channel it sends the message "i'm iNFeCTeD!" If someone types "ananas" in the channel, it changes the nick to "_XInFected" and tries to take over the channel. With a 1 in 100 chance it ops someone and sends script.ini and sends the message "--==i'M_T00_C00l!==--" to the channel. If someone is kicked, it sends script.ini and sends the message "i'm iNFeCTeD!" With a 1 in 30 chance it ops someone and sends script.ini and sends the message "xx!xx" to the channel. When script.ini is finished it sends #yuckfou "Script.ini successfully sent to [name]" If someone says "hotdiggity" it turns c:\ into an fserve. If someone says letme it turns C:\ into an fserve. If someone says simpsalapim it quits with the message "OH ShiT i aM iNFeCtED" If someone says timesi it temporarily unloads script.ini. If someone says supalag it sends the message "ok, i suck cock." If someone says eatshit it sends the message "FUCK YOU ALL FAGGOTS FUCK YOU ALL FAGGOTS FUCK YOU ALL FAGGOTS FUCK YOU ALL FAGGOTS FUCK YOU ALL FAGGOTS FUCK YOU ALL FAGGOTS FUCK YOU ALL FAGGOTS FUCK YOU ALL FAGGOTS FUCK YOU ALL FAGGOTS FUCK YOU ALL FAGGOTS FUCK YOU ALL FAGGOTS "
IRC/Sleeper.217 It sends when the user enters the channel, waits 60 seconds, then starts again. It contains the text "serious discussion! dcc me"
IRC/Sleeper.224 If the text " " is sent in a private message, it halts. It sends when the user enters the channel, waits 60 seconds, then starts again.
IRC/Sleeper.225 If the text " " is sent in a private message, it halts. It sends when the user enters the channel, waits 60 seconds, then starts again.
IRC/Sleeper.236 If the text "!paguy" is sent in the channel, it turns c:\movies into an fserve. It sends when the user enters the channel, waits 60 seconds, then starts again.
IRC/Sleeper.246 If the text " " is sent in a private message, it halts. It sends when the user enters the channel, waits 60 seconds, then starts again. It contains the text: amoua@ucdavis.edu.
IRC/Sleeper.255 If the text " " is sent in a private message, it halts. If the text inferno6 is sent in the channel it sends them "k". It sends when the user enters the channel, waits 60 seconds, then starts again. It contains the text: 3que es lo que pasa.
IRC/Sleeper.266 If the text " " is sent in a private message, it halts. If the text inferno6 is sent in the channel it sends them "k". It sends when the user enters the channel, waits 60 seconds, then starts again.
IRC/Sleeper.267 If the text " " is sent in a private message, it halts. If the text inferno6 is sent in the channel the sender gets sent "k". It sends when the user enters the channel, waits 60 seconds, then starts again.
IRC/Sleeper.284 If the text " " is sent in a private message, it halts. If the text inferno6 is sent in the channel the sender gets sent "k". It sends when the user enters the channel, waits 60 seconds, then starts again.
IRC/Sleeper.287 If the text " " is sent in a private message, it halts. If the text inferno6 is sent in the channel the sender gets sent "k". It sends when the user enters the channel, waits 60 seconds, then starts again.
IRC/Sleeper.295 If the text " " is sent in a private message, it halts. If the text 7abzy7 is sent in the channel the sender gets sent your nick. It sends when the user enters the channel, waits 60 seconds, then starts again.
IRC/Sleeper.451 If the text " " is sent in a private message, it halts. It contains the text: flash. It sends when the user enters the channel, waits 60 seconds, then starts again.
IRC/Sleeper.512 If the text " " is sent in a private message, it halts. If the text inferno6 is sent in the channel the sender gets sent "k". It contains the text: Histoires épaisses It sends when the user enters the channel, waits 60 seconds, then starts again. If the text !Histoire is sent in the channel the sender gets sent "Désolé [Their nick] les histoires épaisses sont pas ouvertes...".
IRC/Sleeper.883 If the text " " is sent in a private message, it halts. If the text inferno6 is sent in the channel the sender gets sent "k". It sends when the user enters the channel, waits 60 seconds, then starts again. When mIRC is started it sends #jeepwarz "Hi. [ip] on [server]"
IRC/Sleeper.1026 If the text " " is sent in a private message, it halts. It sends when the user enters the channel, waits 60 seconds, then starts again. If someone types "shirak" in the channel, it sends "c:\win95\system.cb" If someone types "Durak" in the channel, it turns "c:\mirc" into an fserve. If someone types "shirac" in the channel, it sends "c:\linux\etc\passwd." If someone types "shirat" in the channel it sends "c:\unix\etc\passwd." It sends actions to the channel #x3212. It sends SCRIPT.INI when the user joins the channel.
IRC/Sleeper.1115 If the text " " is sent in a private message, it halts. It sends when the user enters the channel, waits 60 seconds, then starts again. It contains the text: amoua@ucdavis.edu. When mIRC is started it sends #jeepwarz "Hi. [ip] on [server]"
IRC/Sleeper.2492 If the text " " is sent in a private message, it halts. If the text inferno6 is sent in the channel the sender gets sent "k". It sends when the user enters the channel, waits 60 seconds, then starts again. If someone types "ananas" in the channel changes the nick to "_XInFected" and tries to take over the channel. It attempts to detect if they are being followed, says: "Following me?", and halts It contains the text: "if you are banned but still opped, unban self"
IRC/Sleeper.3022 If the text " " is sent in a private message, it halts. If the text inferno6 is sent in the channel the sender gets sent "k". It contains the text: It sends when the user enters the channel, waits 60 seconds, then starts again. It attempts to detect if they are being followed, says: "Following me?", and halts It contains the text: "if you are banned but still opped, unban self"
IRC/Sleeper.4610 If the text " " is sent in a private message, it halts. If the text inferno6 is sent in the channel the sender gets sent "k". It contains the text: Histoires épaisses It sends when the user enters the channel, waits 60 seconds, then starts again. If the text !Histoire is sent in the channel the sender gets sent "Désolé [Their nick] les histoires épaisses sont pas ouvertes...". It contains the text: "Peux pas me faire ça à moi-même", "Pour jouer faut tu tapes: !Mots", "Faut absolument tu tapes 5 mots pis tapes des noms.", "!Mots papate camion souffleuse raie pelle", and "Bon envoye joue maintenant!!!!"
IRC/Story.4543 On loading, it adds SimpleSmn to the user's notify list. The notify list is a list of users the user for which the wishes to be notified when they connect to IRC. The virus stores a second copy of the script as C:\Windows\script1.ini. This is an attempt to protect the script if it is deleted while mIRC is running. If the user types /BY, it displays (in different colours)
```
<< Mirc Worm Jack-In-The-Box >> 
```
If someone on the notify list joins IRC, it checks if the name is SimpleSmn. If so, it sends him the message "I'm on irc." Otherwise, it will have mIRC ignore and not display any further messages from that user, then after a delay, it sends them the message
```
"Hey, I can't talk right now but I wanted to send you this file. It has a funny story you
should read, and also has macros inside that protect you from a lot of viruses. Just open
the document, enable the macros, and if you are infected it will get rid of the virus" 
```
Then after a delay, the script will send an infected file called c:\windows\story.doc to the person. Then it will clear the history screen. If someone on the notify list leaves IRC, it clears the history screen. If someone joins a channel containing someone called help or nohack, it will leave the channel and delete the C:\mirc\script.ini If the infected person receives a file from anyone, it immediately sends "C:\Windows\Story.doc" If someone on invites an infected user to a channel, after a delay, it sends him the message "Thanks for the invite" and tells mIRC not to display any further messages from that user, then after a delay, it sends the message
```
"I'm a little busy so I can't talk much now. I thought you might want to look at this file I 
got. It has a funny story and also has macros in it which get rid of any macro viruses. Just 
enable the macros when the prompt comes up and it will scan for any viruses and clean them." 
```
Then after a delay, the script will send an infected file called c:\windows\story.doc to the person. Then it will clear the history screen. If someone sends a private notice saying "Simplicity" it gives them full access to the hard drive. If someone says "script", "worm", "Jack[any number of characters]Box", "virus", "infect", "macro" or "Story.doc" it ignores them and no further messages from that user will be displayed on the screen. If someone says "Hi", "!", "Hey", or "Hello", the virus will open a connection to one the mail servers (open relays?):
```
mirc.com
georgecarlin.com
carrottop.com
anvdesign.net
symantec.com
drsolomon.com
www.bocklabs.wisc.edu
ebay.com 
```
and sends an e-mail to one of:
```
evrt@avp.com
samples@datafellows.com
virus_research@nai.com
tech_support@nai.com 
```
It will have a random from and subject field and the body "Jack-In-The-Box Has Popped Up Again!"
IRC/TooLame.824 On loading, it sends a message to #w81zdw saying Your Name "just loaded the trojaned script.ini" On unloading it quits with the message" I tried unloading script.ini!!!" If someone says *I*0wn*this*channel* it ops them. If someone sends "b33p" it turns c:\ into and fserve. It spys on activities by sending them to #w81zdw. It sends script.ini on joining. If someone CTCPs it, then it replies "I am 0wned By user anonymous and halts. If someone sends "DIE" in a CTCP then it says "UTC DIE Request Recieved. Excuting..." It someone sends "DO" in a CTCP, it will do whatever comes after it.

IRC/TooLame.2000 On loading, it sends a message to #w81zdw saying Your Name "just loaded the trojaned script.ini" On unloading it quits with the message" I tried unloading script.ini!!!" If someone says *too*lame* it ops them. If someone sends "b33p" it turns c:\ into and fserve. It spys on activities by sending them to #w81zdw. It sends script.ini on joining. Then send a message to #w81zdw saying "[your name] just joined [channel]" If someone says "pl0p", it sends them a notice saying "[nick] AntiLamer v0.2 By Mr. Undernet" and halts. If someone says "Quit" it halts. It someone sends "DO" in a CTCP, it will do whatever comes after it. It fakes unloading itself when you try to remove it from mIRC. It contains the comment:

;---------------------------------Protection Script-----------------------------
;This Script.ini file protects you from the rogue files that 
;mess with mIRC.  New versions are made daily so it is
;is hard to be sure all files aren't bad. 
;Keep this file loaded at all times. It Provides 24 Hour
;Protection against most script.ini attacks.
;The way it works is it reads, the files loaded into the remote.
;If a file is found to be infectionous, it will be automaticly unloaded 
;and you will be notified.  It moiters DCCs for know file size of the scripts.
;Please ignore the auto DCC send of file to people on join. 
;This is to spread this file to stop the spread of the real script.ini
;If you find a script.ini that gets by this file, please mail 
;script.ini@geocities.com...Please include the file 
;a description of what happened, name, e-mail and
;IRC nickname.  You will be notified of newer version of
;this protection script.  Help channels provide help
;to get rid of the file if you become infected.
;                                   -thanx, User Anonymous

IRC/Unable.512 If someone types 8610 it ops the sender. If someone types 8630 it ignores whatever comes after it. If someone types 8640 it exits. If someone types 8650 it kicks whatever comes after it. If someone types 8660 it bans whatever comes after it. If someone types 8670 it sends the sender whatever comes after it. If someone types 8680 it auto-ops the sender. If someone types 8690 it protects the sender. If someone enters the channel, it sends script.ini. This variant is truncated.
IRC/Unable.1267.A If someone types 8600 it does whatever comes after it. If someone types 8610 it ops the sender. If someone types 8630 it ignores whatever comes after it. If someone types 8640 it exits. If someone types 8650 it kicks whatever comes after it. If someone types 8660 it bans whatever comes after it. If someone types 8670 it sends the sender whatever comes after it. If someone types 8680 it auto-ops the sender. If someone types 8690 it protects the sender. If someone enters the channel, it sends script.ini. It adds fake commands for /unload, /remove, /play, /remote, /events and /sreq. It creates and loads irc.ini which allows anyone typing 8900 to do any command. It sets the read-only and system attributes for script.ini. If anyone mentions script.ini or virus it ignores them.
IRC/Unable.1267.B If someone types 8600 it does whatever comes after it. If someone types 8610 it ops the sender. If someone types 8630 it ignores whatever comes after it. If someone types 8640 it exits. If someone types 8650 it kicks whatever comes after it. If someone types 8660 it bans whatever comes after it. If someone types 8670 it sends the sender whatever comes after it. If someone types 8680 it auto-ops the sender. If someone types 8690 it protects the sender. If someone enters the channel, it sends script.ini. It adds fake commands for /unload, /remove, /play, /remote, /events and /sreq. It creates and loads irc.ini which allows anyone typing 8900 to do any command. It sets the read-only and hidden attributes for script.ini. If anyone mentions script.ini or virus it ignores them.
IRC/Unable.1268 If someone types 8610 it ops the sender. If someone types 8630 it ignores whatever comes after it. If someone types 8640 it exits. If someone types 8650 it kicks whatever comes after it. If someone types 8660 it bans whatever comes after it. If someone types 8670 it sends the sender whatever comes after it. If someone types 8680 it auto-ops the sender. If someone types 8690 it protects the sender. If someone enters the channel, it sends script.ini. It adds fake commands for /unload, /remove, /play, /remote, /events and /sreq. It creates and loads irc.ini which allows anyone typing 8900 to do any command. It sets the read-only and system attributes for script.ini. If anyone mentions script.ini or virus it ignores them.

Virus Page