new flavor nick change bot.

U · Eleet Joined: 18 Jun 2003 Posts: 521 Location: IRC

Interesting if galaxynet doesn't mind this either-you would think in the current IRC climate you wouldn't want to support anyone doing such things, but I guess some people still do.

tiko · none Joined: 24 Sep 2003 Posts: 49

a little update.. sexo bots connect to irc.serbiancafe.ws in channel #sexo. i saw 7 when i joined.. not many, but could be another version out there somewhere.

chrishogben · Lurker Joined: 09 Sep 2003 Posts: 218 Location: UK

Just adding some 2 cents from some recent observations.

I've started getting these bots today, and have already noticed their effects. From what i've seen, they connect under a seemingly legitable nickname, and realname, and join some, if not all, the following channels:

#Chatzone #TeenParty #beginners #cybercafe #sexo #allnitecafe #cybersex #beginner #sex

They sit in these channels, and do nothing unless they are messaged. When they are, they usually respond with a greeting first, then the propogation URL:

[15:31:55] <heinz> Hi..?
[15:31:56] <vanny> do i know u ?
[15:32:00] <vanny> wanna see my erotic video ? it is here [url removed]

The URL in question here, was located on a free hosting site, and requires you to physically click another link to download the file.

Inspection of the file from this variant suggests it is an installer, created by Instyler Ex-it! v2.1. Unfortunately, the copy I got was made with a Trial version, and therefore cannot be run properly Surprised

Anyway, thats about all I got from todays experiences. I hope this information is useful to someone out there.

All the best.

Guest · Posted: Mar 13, 2004 6:55am Post subject:

Do you know it's name? (the virus's)

ed · Posted: Mar 13, 2004 8:01am Post subject:

It's been reported to be a new flavor of Fyle. (Sophos, McAfee USA)

It joins #anime, #AllNiteCafe, #Beginner, #Cafebleu, #Casual, #CasualChat, #Chat-World, #Chatterz, #Chatzone, #CyberCafe, #CyberChat, #CyberFriends, #CyberParty, #CyberWorld, #FunnyWorld, #SpeakEasy, #Teen, #TeenFactory, #TeenLounge, #TeenParty, #Teens, #TeenWorld, #TeenZone, #Worldchat, #Teensex, #klsex, #freesex, #sexo, #lesbians, #homo, #gays, #beginners.

If you have PM filters, block www.*.com/erotica/myvideo.exe OR *erotic video*

If you are running Unreal, go to this thread for a possible fix.

On kick, it tries to rejoin the channel in 60 seconds.

It has about 900+ nicknames that it seems to choose from, so g'luck banning with that method.

typobox43 · none Joined: 12 Feb 2004 Posts: 8

Hmmm... Possibly another fyle creation?

.-------------------[ whois nikolos ]----------------------------
| userhost: morris@217.156.60.hidden-42141
| usermode: (Unknown)
| Regged: No
| Bot: No
| Realhost: N/A
| ircname: jasen
| channel: #wildsword #Lord-Dragon #camelotsystems #pcmaster #Otaku_Syndicate #Wing-Commander #Odinbalz #waiting_bar
| idle: 0:00:05
| SignOn: Fri Apr 16 06:35:55 2004
| away: (not away!)
| server: infinity.beyondirc.net (Billings Montana Beyondirc Server)

This one's a bit different from the one discussed in this thread... For one, it uses male names rather than female names, and it's just cycling random channels across the network rather than targeting specific ones. Also (you can't really tell from this paste...) the ircname/GECOS has a space in front of it. Has anyone else seen any of these matching this behavior, so I can get on writing a module for IRCDefender to zap them? I wrote the defender module that kills the ones discussed in this thread, so I figure I'll give this one a go too Smile