SR News: mIRC virus is NOT a hoax


       A virus via IRC?

There's currently a threat that you should be aware of if you use  the  mIRC
program to chat over the internet. mIRC is a popular program used to  access
the IRC (Internet relay Chat). mIRC  supports  a  script  language  that  is
interpreted by the mIRC program; the mIRC sripts and can be  sent  as  files
from one user to another. This script  language  can  automatically  execute
commands and can perform a specific commands triggered on  predefined  words
that someone types during the chat.

There are currently a number (we count  ten  slightly  different  worms)  of
worms that can be spread to your PC. We define these as worms not as viruses
since they do not modify existing programs on  your  PC  but  rather  simply
transfer themselves from PC to PC.

The worms travel via a file named SCRIPT.INI which must be transferred  into
the mIRC program directory in order to execute. Versions of the mIRC program
prior to version 5.3, will transfer a downloaded SCRIPT.INI  file  into  the
same directory with the mIRC program. This allows  the  SCRIPT.INI  file  to
automatically be executed. (This serious flaw  was  promptly  fixed  by  the
author with version 5.3 where all downloads  go  into  a  separate  download
directory by default.)

The most common mIRC worm is called Simsalapim. When someone has this  worm,
it will send the SCRIPT.INI file via DCC. The recipient will get  a  message
that someone wants send them the SCRIPT.INI file unless they have  "AUTOGET"
turned on (it's off by default). They can  choose  to  "get",  "cancel",  or
"ignore" the file. If the user accepts (gets) the file (and if it is  placed
in the mIRC program directory as it is prior to version 5.3 of  mIRC),  they
too will become infected. (They will not  be  aware  of  this!)  The  script
performs an action when a  user  joins  or  leaves  the  channel  and  sends
SCRIPT.INI to this user.

All replication is quite simple in the mIRC  script  language  and  requires
only three lines in the SCRIPT.INI file.

Simsalapim reacts to specific keywords (typed by  anyone  on  the  channel).
Most of these actions are simple annoyances (no real damage is done). A user
can be removed from  the  channel  and  someone  can  takeover  as  "channel
operator".

        How to protect yourself

It's easy to protect  yourself  against  these  mIRC  worms  (they  are  NOT
viruses!) If you don't use mIRC, then you are not at risk.  If  you  do  use
this mIRC then you should:

   1.Do not accept files from people you don't know. In particular NEVER
    accept a SCRIPT.INI file. (If you do need  to  download  SCRIPT.INI  for
    some reason, then make sure you follow the next step.)

   2.Upgrade to version 5.3x of mIRC. This version makes a separate download
    directory the default (so these worms can no longer spread in this way).

   3.Do not turn on "AUTOGET". This enables  someone  to  send  you  a  file
    without your knowledge (unless you use something like Integrity Master).

The latest updates regarding mIRC worms

Based on the latest reports, we can  announce  that  the  mIRC  version  5.3
upgrade stops all the existing mIRC worms.  As  far  as  we  can  tell  this
eliminates the exposure in mIRC that allowed such worms  to  spread  in  the
first place so we don't expect to see any further mIRC worms.  Still,  there
are a large number of programs used to access the internet  and  it's  quite
likely that other such security exposures exist now and in the  future.  For
this reason, we strongly recommend that everyone  periodically  run  a  full
integrity check of their system; this will assure that their system has  not
been damaged in some way by deliberate attack or other defects in software.


Protection against these mIRC worms is quite simple. It just takes a  little
bit of knowledge. But remember, someone can send you a virus or  trojan  but
they can not do it without your permission. Carefully check any  executable,
MS Word, or MS Excel files that you receive  via  the  internet.  (Integrity
Master is great way to check all your files!)

Write to Stiller Research: support@stiller.com

                                   Copyright c 1997-1998 Stiller Research.
                                   Document Last Modified March 24, 1998.

[=- 㡫  ୠ ᪨ 蠫 //  #2 //  1998  -=]
 V >            L *.FRM "     h  /    >     M  "]  d*.MACk  o 0   s     "  "    ;O  