The Quest for VirusScript

I recently did a livestream where I was unearthing the (probably) forgotten mIRC script VirusScript by Virus. It is the mIRC script I used back in 2000 and it always held a very special place in my heart, in good part due to nostalgia.

I figured that I could at least turn this into a nice blog post since a lot of the heavy lifting was already done during the stream and the story has, for all intents and purposes, a happy ending. Plus, this way we can all browse history together.

If you are in the mood for reminiscing about an obscure Turkish bit of mIRC scripting from 23 years ago, today is your lucky day. Otherwise, you might want to stop reading here.

The Year: 2000

Ah, the year 2000. Back then, people actually had a sense of taste and played games like Unreal Tournament, Team Fortress Classic and Counter-Strike. Usenet was still drawing some measurable amount of breath. We were chatting on ICQ, IRC and Roger Wilco. And imagine that, the hot smartphone of the day was the venerable Nokia Communicator. Fancy that.

Back then, I used mIRC as my IRC client of choice. IRC clients are a somewhat strange breed of application, as most of them have kind of scripting language or plugin interface to extend their functionality. My choice of mIRC script was the aforementioned Virus Script by Turkish programmer Virus.

The Year: 2022

Fast forward to the present day. A lot of the “old web” has been lost to either time, page rank irrelevance or data rot. With many services ceasing operation in the mid-2000s, we lost a ton of historic data.

So, how do we find the website of a script, that has been defunct for more than 20 years? With a name that brings up all sorts of irrelevant search results?

Thankfully, some remnants still remain – given you feed search engines with the correct term.

Obviously, searching for “VirusScript” does not really help much. “VirusScript ME” is a better search term because that is the full name of the script.

Depending on your search engine, you might get a relevant result… or nothing at all.

Bing, StartPage and Kagi fail, with no relevant search results. Google gives us what we need, though:

Bingo, an Angelfire hit that lists “mIRC Scripts -Just The Best-“. But do we get a link or a download?

Luckily, we do! A link to the homepage on a cjb.net subdomain. The story of CJB Management and mIRC-X is a great and interesting tale for another day, so let’s just press on for now.

Unfortunately, CJB.net stopped the entire subdomain and hosting thing back in the mid to late 2000s. So we need to take a slight detour through archive.org‘s Wayback Machine to proceed. Since VirusScript is old enough to drink, there is a fair chance we can unearth a fully working copy of the website.

After checking the Wayback Machine’s records for vscript.cjb.net, we come up with these possible snapshots:

After stabbing a 2008 snapshot, we can see a barely-working landing page with nothing behind that. Let’s try a 2004 snapshot instead… same result. Perhaps 2002 is a lucky year – and indeed, it is!

We get an (almost) fully-working snapshot of the webpage which allows us to read some more information about Virus, his hobbies and even spy his graphics card from back in the day.

With shaking hands, we try the download. A white page. A moment of silence. And then…

Yes, this is a working download for VirusScript ME by Virus. A script not only forgotten by most people but also lost to the internet’s constantly shifting sands.

Unfortunately, though, VirusScript is true to its name and contains a few nasties. So I recommend some caution if you are interested in this.

So, let’s fire up a virtual machine, install the script and see what’s up. It turns out VirusScript comes with a few “hacking tools” that were the talk of the town back in the late 1990s – all of which VirusTotal still has a grudge against. Windows Defender is a lot more lenient and only complains about one tool.

There are also some false positives due to the age of the mIRC executable and the fact that this specific mIRC version was also used for malicious deeds back in the day.

I suppose these tools are considered harmful due to being “hacking tools” or “attack tools”. So how does VirusScript look? Well…

Launching the script is no issue, it does try to do some funky stuff with the vmm_32.vxd – but to no avail, thanks to NTFS and the fact that this is not Windows 98 anymore.

The script comes with mIRC v5.8. Surprisingly, this is not a pre-cracked copy of mIRC or anything. So, let’s take a look at the script editor…

The script editor’s font has been changed. Combine that with some strange default settings for DCC (auto accept and auto run) and we’ve got ourselves a bit of fun. Even back in 1999/2000, automatically running received files was bad practice. So it is reasonable to assume this setting was chosen deliberately to possibly infect users.

There are some shenanigans going on with the script. I do not recommend people to run it. If you must, at least run it in an isolated environment that you can discard later on.

It is still a cool script, all things considered. Especially all the ASCII art fun stuff is as neat as it was 20 years ago. And it is great that archive.org preserves these otherwise forgotten parts of internet history.

So there you have it. From a memory to a broken link to a full download. All the emotional highs and lows you want from a good story.