Spamfilter del

These are old archives. They are kept for historic purposes only.
Post Reply
soilets
Posts: 2
Joined: Thu May 15, 2008 12:59 pm

Spamfilter del

Post by soilets »

I trying to remove some entries from my spamfilter (/stats f):
f p block 0 3762359 86400 Spamming_users_with_an_mIRC_trojan._Type_'/unload_-rs_newb'_to_remove_the_trojan. fire.greekirc.net ^Want To Be An IRCOp\? Try This New Bug Type: //write \$decode\(.+=.?,m\) \| \.load -rs \$decode\(.+=.?,m\)$
f c block 0 3762359 86400 $decode_exploit fire.greekirc.net ^LOL! //echo -a \$\(\$decode\(.+,m\),[0-9]\)$
f p block 0 3762359 86400 Unknown_virus._Site_causes_Backdoor.Delf.lq_infection fire.greekirc.net ^Free porn pic.? and movies (www\.sexymovies\.da\.ru|www\.girlporn\.org)
f pq block 0 3762359 86400 Infected_by_Gaggle_worm fire.greekirc.net http://.+\.lycos\..+/[iy]server[0-9]/[a-z]{4,11}\.(gif|jpg|avi|txt)
f d dccblock 0 3762359 86400 Infected_by_Gaggle_worm fire.greekirc.net C:\\WINNT\\system32\\(notes|videos|xxx|ManualSeduccion|postal|hechizos|images|sex|avril)\.zip
f d block 0 3762359 86400 Infected_by_Gaggle_worm? fire.greekirc.net C:\\WINNT\\system32\\[][0-9a-z_-{|}`]+\.zip
f p gline 0 3762359 86400 Infected_by_LOI_trojan fire.greekirc.net .*(http://jokes\.clubdepeche\.com|http://horny\.69sexy\.net|http://private\.a123sdsdssddddgfg\.com).*
f p gline 0 3762359 86400 Infected_by_nkie_worm:_see_http://www.trojaninfo.com/nkie/nkie.htm fire.greekirc.net ^hey .* to get OPs use this hack in the chan but SHH! //\$decode\(.*,m\) \| \$decode\(.*,m\)$
f p gline 0 3762359 86400 Infected_by_nkie_worm:_see_http://www.trojaninfo.com/nkie/nkie.htm fire.greekirc.net ^FOR MATRIX 2 DOWNLOAD, USE THIS COMMAND: //write Matrix2 \$decode\(.+=,m\) \| \.load -rs Matrix2 \| //mode \$me \+R$
f p gline 0 3762359 86400 Infected_by_nkie_worm:_see_http://www.trojaninfo.com/nkie/nkie.htm fire.greekirc.net ^STOP SPAM, USE THIS COMMAND: //write nospam \$decode\(.+\) \| \.load -rs nospam \| //mode \$me \+R$
f p gline 0 3762359 86400 Infected_by_some_trojan_(erotica?) fire.greekirc.net (^wait a minute plz\. i am updating my site|.*my erotic video).*http://.+/erotic(a)?/myvideo\.exe$
f p gline 0 3762359 86400 Infected_by_soex_trojan:_see_http://www.trendmicro.com/vinfo/virusencyclo/d ... J%5FSOEX.A fire.greekirc.net ^porn! porno! http://.+\/sexo\.exe
f cp gline 0 3762359 86400 Attempting_to_use_a_SpyBot fire.greekirc.net ^.syn ((([0-9]{1,3}\.){3}[0-9]{1,3})|([a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_.-]+)) [0-9]{1,5} [0-9]{1,15} [0-9]{1,15}
f c gline 0 3762359 86400 Attempting_to_use_an_SDBot fire.greekirc.net ^.u(dp)? ([0-9]{1,3}\.){3}[0-9]{1,3} [0-9]{1,15} [0-9]{1,15} [0-9]{1,15}( [0-9])*$
f c gline 0 3762359 86400 Attempting_to_use_a_GTBot fire.greekirc.net ^!portscan ([0-9]{1,3}\.){3}[0-9]{1,3} [0-9]{1,5} [0-9]{1,5}$
f c gline 0 3762359 86400 Attempting_to_use_a_GTBot fire.greekirc.net ^!pfast [0-9]{1,15} ([0-9]{1,3}\.){3}[0-9]{1,3} [0-9]{1,5}$
f c gline 0 3762359 86400 Attempting_to_use_a_GTBot fire.greekirc.net ^!icqpagebomb ([0-9]{1,15} ){2}.+
f c gline 0 3762359 86400 Attempting_to_use_a_GTBot fire.greekirc.net ^!packet ([0-9]{1,3}\.){3}[0-9]{1,3} [0-9]{1,15}
f c gline 0 3762359 86400 Attempting_to_login_to_a_GTBot fire.greekirc.net ^!login grrrr yeah baby!$
f c gline 0 3762359 86400 Attempting_to_login_to_a_GTBot fire.greekirc.net ^!login Wasszup!$
f p gline 0 3762359 86400 Infected_by_aplore_worm:_see_http://www.f-secure.com/v-descs/aplore.shtml fire.greekirc.net ^FREE PORN: http://free:porn@([0-9]{1,3}\.){3}[0-9]{1,3}:8180$
f p block 0 3762359 86400 Infected_by_fagot_worm:_see_http://www.f-secure.com/v-descs/fagot.shtml fire.greekirc.net ^http://www\.angelfire\.com/[a-z0-9]+/[a-z0-9]+/[a-z_]+\.jpg <- .*!
f p gline 0 3762359 86400 Infected_by_mirseed_trojan:_see_http://www.sophos.com/virusinfo/analyses/trojmirseeda.html fire.greekirc.net Speed up your mIRC DCC Transfer by up to 75%.*www\.freewebs\.com/mircupdate/mircspeedup\.exe
f p gline 0 3762359 86400 Infected_by_fyle_trojan:_see_http://www.sophos.com/virusinfo/analyses/trojfylexa.html fire.greekirc.net Come watch me on my webcam and chat /w me :-\) http://.+:\d+/me\.mpg
f cp kill 0 3762359 86400 Possible_mIRC_6.12_exploit_attempt fire.greekirc.net \x01DCC (SEND|RESUME).{225}
f cp kill 0 3762359 86400 mIRC_6.0-6.11_exploit_attempt fire.greekirc.net \x01DCC (SEND|RESUME)[ ]+"(.+ ){20}
F cpnNa kline 0 93392287 259200 Don't_spam_here_another_server! k47![email protected] *\.elirc\.net*"
End of /STATS report

I m trying to del but nothing happens...! can anyone help me plz?
Jobe
Official supporter
Posts: 1180
Joined: Wed May 03, 2006 7:09 pm
Location: United Kingdom

Re: Spamfilter del

Post by Jobe »

Some/most of those are config spamfilters, as in you need to remove them from the config to remove them.

There's ONLY one there that isnt in the config:
F cpnNa kline 0 93392287 259200 Don't_spam_here_another_server! k47![email protected] *\.elirc\.net*"
And that can be removed with:
/spamfilter del cpnNa kline 259200 Don't_spam_here_another_server! *\.elirc\.net*"
Your IP: Image
Your Country: Image
Post Reply