Lunatik mIRC Worm

Overview

Name Of Virus: Lunatik.a
Virus Author: SpYdA
Type Of Virus: mIRC Worm
Language: Visual Basic 5
Date Coded/Completed: 10th May, 1999
Detected: No (not at the moment anyway)
Encryption: No

On Execution Of enhanced.exe:

When the file enhanced.exe is ran (Lunatik) the user gets a box saying "Congratulations !
Enhancement Successful !" and an OK button, when the button is pressed, the box closes and 
Lunatik has set up what it needs to do.
(note: if the user right-clicks on enhanced.exe and goes to version it says it was made by 
Enhanced mIRC, a bullshit name I put in as to make lamers think its cool :) When enhanced.exe has
been executed it modifies (or creates) Script.ini and Remote.ini.

On Execution Of mIRC:

Okay, now on the next startup of mIRC, heres what happens:

On Connect:

Lunatik copies the file enhanced.exe from the c:\mirc\download dir to c:\program files\accessories
using the mIRC copyfile command. (note: this was done so to make the worm as mIRC based as 
possible, where nesary, I only wanted to use mIRC commands) Then the user joins #virus and says
"I Am Infected With Lunatik.a, The Perfect Headache" they then leave #virus (note: as to make as
sure as possible that the user doesnt see themselves copying files or joining channels on connect
without them knowing, as soon as they part #virus, Lunatik performs a /clear command followed by
a /MOTD (message of the day) command so everything looks normal).

On Joining Of Channels:

When the infected user joins a channel, he/she sends enhanced.exe (from the program files dir so
to avoid AVP picking it up as a warning) to every user who joins the channels that the Lunatik
infected user is in.

On Parting Channels/Quitting mIRC:

Hehe, no changes are made, that's all normal.

Other:

It is possible to *control* a Lunatik infected user via CTCP request through your mIRC client
(thanx to ALT-F9 of the Alternative Virus Mafia for the access code). To do this type: 
/CTCP <nick> <command> (ie: /CTCP Lamer /nick BigLamer, hehe, and that will change their nick :)
You can upload/download files without their knowledge etc and alot of other things (experiment :)

Authors Notes/Greets etc:

Lunatik.a has a couple of downsides (hehe, that's why it's .a, if i find too many expect .b) one
of the biggest ones been that it *only* works on people who have mIRC installed in the default
directory (c:\mirc) If there is a next version, I'll try and get it to find where mIRC is 
installed so it can infect it in any location. The other shitty thing is it's coded in VB5, which
is a fairly limited language, so there might be a ASM version :).

Greets too: All of Ultimate Chaos, everyone that helped, and to whoever is reading this :)

 
