New irc Virus

[X-Trancer]

hi all

Someone can make a Spam filter for this virus

http://socold.de/stuff/schnappi_death.jpg

Not Klick on this Link

[Dukat]

whoops, i clicked it...

where's the problem? it's just a 404 for me...

[codemastr]

Can you show us the text that someone infected with this virus would send to the channel? That is what we need in order to make a spamfilter.

[DeltaAnime]

We've been getting hit by this, too

Here are some examples of how it works

«so``funny``» http://www.irc-fun.tk/stuff/schnappi_death.jpg <-----fun!!!!! http://www.irc-fun.tk/stuff/schnappi_death.jpg <--- YOU HAVE NEVER SEEN THIS BEFORE!!!

«Mastahunter» ‹ EDGEMANIAC › ARE YOU HARDCORE?! http://www.irc-fun.tk/stuff/schnappi_death.jpg <- ONLY HARDCORE PEOPLE CAN VIEW THIS PICTURE ~~ http://www.irc-fun.tk/stuff/schnappi_death.jpg ~~ http://www.irc-fun.tk/stuff/schnappi_death.jpg WARNING: ARE YOU ELEET ENOUGH?!

.:13·10·16:. «EDGEMANIAC» ARE YOU HARDCORE?! http://www.irc-fun.tk/stuff/schnappi_death.jpg <- ONLY HARDCORE PEOPLE CAN VIEW THIS PICTURE ~~ http://www.irc-fun.tk/stuff/schnappi_death.jpg ~~ http://www.irc-fun.tk/stuff/schnappi_death.jpg WARNING: ARE YOU ELEET ENOUGH?!

It seems they're changing the URL as they go.

[Deltaanime]

http://www.irc-fun.tk/stuff/schnappi_death.jpg <--- LOOOOOOOOOOOOOOOOOOOOOOOOOL

That too

[codemastr]

Code: Select all

spamfilter {
	regex "^[a-z0-9.-]+/stuff/schnappi_death\.jpg <--- LOOOOOOOOOOOOOOOOOOOOOOOOOL$";
	target channel;
	action block;
	reason "Infected by unknown mIRC worm/trojan";
};

spamfilter {
	regex "^[a-z0-9.-]+/stuff/schnappi_death\.jpg <-----fun!!!!! [a-z0-9.-]+/stuff/schnappi_death\.jpg <--- YOU HAVE NEVER SEEN THIS BEFORE!!!$";
	target channel;
	action block;
	reason "Infected by unknown mIRC worm/trojan";
};

spamfilter {
	regex "^ARE YOU HARDCORE\?! [a-z0-9.-]+/stuff/schnappi_death\.jpg <- ONLY HARDCORE PEOPLE CAN VIEW THIS PICTURE ~~ [a-z0-9.-]+/stuff/schnappi_death\.jpg ~~ [a-z0-9.-]+/stuff/schnappi_death\.jpg WARNING: ARE YOU ELEET ENOUGH\?!$"; 
	target channel;
	action block;
	reason "Infected by unknown mIRC worm/trojan";
};

Those should do the trick!