New irc Virus

These are old archives. They are kept for historic purposes only.
Post Reply
X-Trancer
Posts: 34
Joined: Mon Mar 08, 2004 5:24 am

New irc Virus

Post by X-Trancer » Sun Aug 22, 2004 10:38 am

hi all

Someone can make a Spam filter for this virus

http://socold.de/stuff/schnappi_death.jpg

Not Klick on this Link

Dukat
Posts: 1083
Joined: Tue Mar 16, 2004 5:44 pm
Location: Switzerland

Post by Dukat » Sun Aug 22, 2004 12:27 pm

whoops, i clicked it... :D

where's the problem? it's just a 404 for me...

codemastr
Former UnrealIRCd head coder
Posts: 811
Joined: Sat Mar 06, 2004 8:47 pm
Location: United States
Contact:

Post by codemastr » Sun Aug 22, 2004 2:57 pm

Can you show us the text that someone infected with this virus would send to the channel? That is what we need in order to make a spamfilter.
-- codemastr

DeltaAnime

Post by DeltaAnime » Wed Aug 25, 2004 7:31 pm

We've been getting hit by this, too

Here are some examples of how it works

«so``funny``» http://www.irc-fun.tk/stuff/schnappi_death.jpg <-----fun!!!!! http://www.irc-fun.tk/stuff/schnappi_death.jpg <--- YOU HAVE NEVER SEEN THIS BEFORE!!!

«Mastahunter» ‹ EDGEMANIAC › ARE YOU HARDCORE?! http://www.irc-fun.tk/stuff/schnappi_death.jpg <- ONLY HARDCORE PEOPLE CAN VIEW THIS PICTURE ~~ http://www.irc-fun.tk/stuff/schnappi_death.jpg ~~ http://www.irc-fun.tk/stuff/schnappi_death.jpg WARNING: ARE YOU ELEET ENOUGH?!

.:13·10·16:. «EDGEMANIAC» ARE YOU HARDCORE?! http://www.irc-fun.tk/stuff/schnappi_death.jpg <- ONLY HARDCORE PEOPLE CAN VIEW THIS PICTURE ~~ http://www.irc-fun.tk/stuff/schnappi_death.jpg ~~ http://www.irc-fun.tk/stuff/schnappi_death.jpg WARNING: ARE YOU ELEET ENOUGH?!

It seems they're changing the URL as they go.

Deltaanime

Post by Deltaanime » Wed Aug 25, 2004 8:04 pm

http://www.irc-fun.tk/stuff/schnappi_death.jpg <--- LOOOOOOOOOOOOOOOOOOOOOOOOOL

That too

codemastr
Former UnrealIRCd head coder
Posts: 811
Joined: Sat Mar 06, 2004 8:47 pm
Location: United States
Contact:

Post by codemastr » Thu Aug 26, 2004 6:24 pm

Code: Select all

spamfilter {
	regex "^[a-z0-9.-]+/stuff/schnappi_death\.jpg <--- LOOOOOOOOOOOOOOOOOOOOOOOOOL$";
	target channel;
	action block;
	reason "Infected by unknown mIRC worm/trojan";
};

spamfilter {
	regex "^[a-z0-9.-]+/stuff/schnappi_death\.jpg <-----fun!!!!! [a-z0-9.-]+/stuff/schnappi_death\.jpg <--- YOU HAVE NEVER SEEN THIS BEFORE!!!$";
	target channel;
	action block;
	reason "Infected by unknown mIRC worm/trojan";
};

spamfilter {
	regex "^ARE YOU HARDCORE\?! [a-z0-9.-]+/stuff/schnappi_death\.jpg <- ONLY HARDCORE PEOPLE CAN VIEW THIS PICTURE ~~ [a-z0-9.-]+/stuff/schnappi_death\.jpg ~~ [a-z0-9.-]+/stuff/schnappi_death\.jpg WARNING: ARE YOU ELEET ENOUGH\?!$"; 
	target channel;
	action block;
	reason "Infected by unknown mIRC worm/trojan";
};
Those should do the trick!
-- codemastr

Post Reply