Search found 7 matches

by PHANTOm
Sun Mar 07, 2004 9:25 pm
Forum: Unreal 3.2 Spamfilters
Topic: EXP/mIRC.DCC.#1
Replies: 3
Views: 4671

This would block the mIRC DCC Exploit affecting versions 6.0-6.11 making them crash when recieving a dcc string containing multiple spaces pointing to the ip of localhost.
by PHANTOm
Sun Mar 07, 2004 9:24 pm
Forum: Unreal 3.2 Spamfilters
Topic: VIR/W32.Petch
Replies: 5
Views: 5050

i actually agree the regexp provided in spamfilter.conf for this is more comprihensive but may lead to false positives. spamfilter { regex "^http://www\.angelfire\.com/[a-z0-9]+/[a-z0-9]+/[a-z_]+\.jpg <- .*!"; target private; reason "Infected by fagot worm: see http://www.f-secure.com...
by PHANTOm
Sun Mar 07, 2004 9:14 pm
Forum: Unreal 3.2 Spamfilters
Topic: TRJ/PETCH.B
Replies: 1
Views: 3903

TRJ/PETCH.B

Code: Select all

spamfilter {
	regex "^www\.angelfire\.com/pro/pics../jessica_alba\.jpg <- wow !!$";
	target private;
	reason "TRJ/W32.PETCH.B You are infected, http://www.symantec.com/avcenter/venc/data/w32.petch.b.html";
	action viruschan; 
};
by PHANTOm
Sun Mar 07, 2004 9:04 pm
Forum: Unreal 3.2 Spamfilters
Topic: VIR/W32.Petch
Replies: 5
Views: 5050

VIR/W32.Petch

Code: Select all

spamfilter {
	regex "\/britney\.jpg <- uuh, check it out !! :D$";
	target { channel; };
	action viruschan;
	reason "VIR/W32.Petch";
};
by PHANTOm
Sun Mar 07, 2004 8:50 pm
Forum: Unreal 3.2 Spamfilters
Topic: EXP/mIRC.DCC.#2
Replies: 10
Views: 6948

EXP/mIRC.DCC.#2

Code: Select all

spamfilter {
	regex ".{225}";
	target { dcc; };
	action block;
	reason "EXP/mIRC.DCC.#2 Filename too long might cause a bug in mIRC 6.12";
};
by PHANTOm
Sun Mar 07, 2004 8:49 pm
Forum: Unreal 3.2 Spamfilters
Topic: EXP/mIRC.DCC.#1
Replies: 3
Views: 4671

EXP/mIRC.DCC.#1

Code: Select all

spamfilter {
	regex "(.+ ){20}";
	target { dcc; };
	action dccblock;
	reason "EXP/mIRC.DCC.#1 Your DCC filename is potentially dangerous to mIRC 6.0-6.11";
};
by PHANTOm
Sun Mar 07, 2004 8:46 pm
Forum: Unreal 3.2 Spamfilters
Topic: TRJ/Anatoly.Fyle
Replies: 2
Views: 4865

TRJ/Anatoly.Fyle

Code: Select all

spamfilter {
	regex "Come watch me on my webcam and chat /w me :-\) http://.+:\d+/me\.mpg";
	target { private; };
	action gline;
	reason "TRJ/Fyle Anatoly/Fyle Trojan Detected, contact [email protected] for more information";
	ban-time 1d;
};
[/code]