Some annoying bots

Koshi · Guest

Wouldn't it be advisible for server admins to set the default usermodes to +s +x (if used in your ircd) so that the users don't show up in channel lists? Also a sort of timer script would be nice, I'd try one myself but Its been years since I've tried scriping mirc.

U · Eleet Joined: 18 Jun 2003 Posts: 521 Location: IRC

Another reason why I think the ability for the warning box that pops up in mIRC to be disabled is a bad idea.

Most people disable it because its annoying, and ignore the warning. I think its not that hard to have to click "YES" to go to a url.

Thats why these things will continue to proliferate-you can warn people till you're blue in the face, but they continue to click on links, accept files from people they don't know, and give anyone their nick and channel passwords Smile

Tonytn · none Joined: 01 Jan 2004 Posts: 4

If you are running Unreal3.2, you can block the spam message from these bots.
We use the 'badwords' feature of Unreal3.2 as a spam blocker. From Version beta 17 and up, you can completely block the message matching the regex you provide in the badwords.channel.conf, badwords.message.conf and badwords.quit.conf
Ex:
badword channel { word "jpg.exe"; action "block"; };
badword channel { word "cam\.zip"; action "block"; };
We have a master list of these three files on an http server. There is a script in the main Unreal dir of each server, which downloads this list 4 times per day, makes a backup of the current list, installs the new one and rehashes the ircd. This way, you only have to update files in one place, and all the servers are always running the same files.
The server must set everyone +G on connect, and we recommend channel owners set channels +G. We disallow users to remove +G via the ircd config. This keeps the spam virus from spreading, as there is no address for the users to click on to become infected.

Chris[ni] · Guest

I am an admin for an IRC network and we have also been suffering from these spam bots, however with a little research we found that these bots are the IRC/fyle virus. You may have worked this out before, but id thought id add my two cents.
The way we solved this was to determine the server that the virus connects bots to and then rename that server.
You can find more information on IRC/fyle on mcafee's website

Guest · Posted: Jan 16, 2004 11:23am Post subject: ED Script

Anyone can say me how make ed script running in bitchx ?

ed · Posted: Jan 16, 2004 4:40pm Post subject:

Thanks to pravie in Undernet's #BitchX:

In BitchX, type: /on MSG "*" { kill $0 No Spam bots }

You can also add it to your ".bitchxrc".

(Note: This will kill anyone who messages the bot with anything)

U · Eleet Joined: 18 Jun 2003 Posts: 521 Location: IRC

The only drawback with using +G to block these bots is then you lose what +G is intended for, and you have to force it on everyone.

I set a bot up that sits in all the larger channels, and if it gets PM'd with this stuff-instant 5 day akill.

Works pretty well.

RejiMC · none Joined: 22 Nov 2003 Posts: 11

this is what i do...

Guest · Posted: Feb 04, 2004 3:06pm Post subject:

I was wondering, could someone send me a copy of the source (if possible) of the virii so i could look it over and protect my network from this thing. I am very good with mirc scripting so anything i come up with i will be glad to share.
If you would email it to Majick@SyntaxIRC.us
I would like the source as well as the file that infects you.

Thank you,
Majick - SyntaxIRC Admin

Timmy|superbands · none Joined: 19 Jan 2004 Posts: 36

mawk · Guest

Hi guys.

I've set up an eggdrop especially for these bots, that gets them, and glines them on my IRCu network.

[2006.25] *** ········································
[2006.44] *** antispam is mawk@the.best.shells.and.webhosting.at.g4-hosting.net
[2006.44] *** antispam is «anti-spam service»
[2006.44] *** antispam on mainhub.bewbies.org
[2006.44] *** antispam is an IRC Operator
[2008.41] *** antispam on @#a_spam_trap, @##
[2006.44] *** antispam idle 3 hr 10 min 30 s, signed on «Tue 3rd Feb 2004 11:26p»
[2006.44] *** ········································

## is the first channel on the /list, and when they ignore the first channel, #a_spam_trap works as a 'backup', thus the first channel that these bots will join. So, some basic code and some trial and error, and you get this.

[1656.01] (UWorld): [22:56:26] NICK H]_` YMxCxS@ndf-dial-196-30-124-140.mweb.co.za on server sanjose.ca.us.bewbies.org
[1656.01] (Socks): [22:56:26] Scanning host ndf-dial-196-30-124-140.mweb.co.za
[1656.03] (Socks): [22:56:28] Scanning Complete for host ndf-dial-196-30-124-140.mweb.co.za
[1656.03] (UWorld): [22:56:28] JOIN ## by H]_`
[1656.06] (UWorld): [22:56:31] GLINE by antispam
[1656.06] (UWorld): [22:56:31] QUIT by H]_` :G-lined

this tcl will gline anyone who is not +f on the bots userlist. so its not a good idea, to yet, put him into your main channels Razz

email me for the tcl, and i'll send it to you.

mawk (Marc) - marcandana@iprimus.com.au

irc.bewbies.org - www.bewbies.org
- founder.

Messenger · none Joined: 22 Feb 2004 Posts: 3

Hey you all.If you set the bots as "bad word" in the badword conf, and set the channels to +r ( registered nicks only) this will keep the bots from pming, and if they do not register their nicks, will also not enter the +r channels.It works, I had the same problem.

(Moderator's Note) URL Removed: Unrelated

Messenger

Messenger · none Joined: 22 Feb 2004 Posts: 3

Guest just have you're shell provider blackhole (ipfw) the lamer.Then you won't have to reconfigure anything.Then when the lamer tries connecting, it will look as if you shut the doors to your network.Just send your System Administrator the ip and host of the lamer you want blackholed. Smile

Messenger

U · Eleet Joined: 18 Jun 2003 Posts: 521 Location: IRC

Not all ISPs are willing to do this-but if you have a ircd that supports it, you can zline the offending IP.

upinsmoke · Posted: Mar 09, 2004 2:25am Post subject:

i didnt see this module mentioned so maybe it will be helpful Smile

if you run unrealircd 3.2 try using this 3rd party module (scarecrow 0.0.7)

http://sourceforge.net/projects/ircdxp/

it prevents the spam bots from joining channels and spamming but it doesnt

stop them from registering there nick