UnrealIRCd Forums

hi guys, although maybe a bit late, heres the posting from a guy that states he is the author of that virus, on a "security board":

Hello to everyone, i`m sending the source code of my worm, it is written in visual basic, comments in source are on my lenguage! Everybody who undestend the VB will understand the code.
short tipps: using the emission method by e-mails on the way that checks the HD ,
and searching e-mails from files. Secound method is by IRC-sending invite to private webserver (on that server are lists of interesting files, as JVM exploit which is infecting automaticaly the visitor whit buged browser.....ok, other things you will see in code smile.gif


sorry for my lousy, miserable english


30.09.2004
greets from ACIdCooKie (old/skool)
see ya next time bro hehehe
icq: 44625824
[email protected]

http://www.governmentsecurity.org/forum ... opic=11582

Here is all the info:
It chooses between one of 74 servers at random. The servers and channels are:
irc.ablenet.org
6667
#ablenet
#anesthesia
#idle
#awib
#Uno
#wrestling
#Raknor
#fow
irc.accessirc.net
6667
#uknova
#accessirc
#norge
irc.afternet.org
6667
#AfternetRPG
#twilightzone
#hawt
#CBS
#KittyKat
irc.afterx.net
6667
#Adults18+
#AmigaIRC
#ctrlaltdel
208.179.62.249
6660
#warezone
#ttr|movies
#ump|movies
#the-archives
#elite-xdcc
irc.amcool.net
7000
#scorpio
#movie-zone
#nse-movies
#warezrockz
#xtreme-warez
#tlb-dvd
#ad-pr0nz
#ad-warez
irc.angeleyez.net
7000
#24HourCafe
#gamesgalore
#PuNkS
#Party
#GenteLatina
#scriptworld
#Scriptz
#Js2000
irc.animeirc.de
6667
#magu
#anime
#la2
#sailormoon
irc.aniverse.com
6662
#alphaanime
#anime-4ever
#a.d.clan
#rm2k_anime
#jdrama
#a2000a
#catgirls
#animesource
#ANIWORLD
irc.arabmirc.net
6662
#KuwaiT2
#doha
#kuwait25
#kuwait
irc.astrolink.org
6662
#speccy
#astrolink
#pan
#kwa
irc.asylum-net.org
7000
#wuzzle
#idle
#mik3y
#roadhouse
#chatpoint
#bjork
irc.aurosoniq.net
7000
#welcome
#mirc
#wizard
#interact
#music
#mel
irc.awesomechat.net
6667
#awesomeradio
#mircpopup-magic
#warezrus
#Bar-n-Grill
#mp3z
#loonybin
irc.axenet.org
7000
#spanishare
#hardcoreregime
#axenet
#wobblyworld
#rip-curl
#hardcore
irc.bdsm-net.com
6667
#bondagetheater
#SDR-radio
#submissively_yours
#Submission
#bondageimages
#Bondagepixs
irc2.beyondirc.net
6660
#comicfiesta
#wing-commander
#idlerpg
#aowarez
#MuSiCStuDio
#UK
#badkar
#weed
#marilynmanson
irc.blabber.net
6667
#bofh
#tengo
#sweet
#trivia
#hooters
#vaalpukke
irc.blitzed.org
7000
#xplicitbreakz
#chat.net
#chatterbox
#German
#maroc
#hants
#europedaytraders
#debug
#help
irc.bolchat.org
6667
#web
#bugojno
#holland
#cazin
#lukavac
#tuzlacafe
#overnet
#tk
#bosnia
irc.bongster.org
6669
#mebu
#german-ftp-wares
#german-ftp-warez
#movie-planet
#thedocnews
#applelinks
#lov
#schattenwelt
#world-warez
eu.brasnet.org
6665
#christ
#fotolog
#agitairc
#MeTRoPoLe
#Introzado
#divulgacao
#niteroi
#acre
#xegadu
#virciu
#Belem
irc.brokenirc.net
7000
#scarecom
#xdcc-pimps
#monster-warez
#acyd_fa_da_brayn
#broken-music
#r2r-warez
irc.chat4all.org
6666
#lounge
#LKA
#kedaikopi
#Holland
#sealife
#jeugdkerk
irc.chatnet.org
6667
#ScotLand
#Romance
#chatzone
#disco
#japan
#india
#ankara
#istanbul
#beginner
#sharjee|
#icons_of_vanity
irc.chatsociety.net
6668
#animewired
#at-games
#aom
#anime-tsudoi
#trekkie-chan
#kawaii-radio
irc.chatspike.net
6667
#chat
#Scissors
#cm-chat
#onix
#oslo
#ssod
#chatspike
#anime-keep
#norge
#darkgalaxy
#Chinese-movies
irc.chung.li
6665
#magicfriends
#segaioli-riuniti
#Bar
#romani
#MiLLeNiuM
#MULTIGAMES
#gurusat
#ITALIAN-CARTOONS
#Shi^Huang^Di
irc.coolchat.net
6667
#mp3-albums
#lacueva
#lastenia
#elite-minds
#inmortales
#tucuman_under
irc.crazednet.co.uk
6665
#mp3-central
#karaoke+mp3z
#movieland
#crazy-chat
#crazednet
irc.dal.net
6663
#dark
#teen
#Amman
#japan
#indonesia
#france
#kuching
#tbilisi
#uitm
#DEPOK
#binus
irc.dark-storm.net
7000
#starsphere
#Fryingdutchmen
#agra
#rock
#colonies
irc.d-t-net.de
6667
#jule
#noteingang
#backupz
#sf-community
#USP
irc.deviantart.com
6667
#deviantart
#modblog
#wotmud
#customize
#DEVART
irc.rizon.net
6669
#wg-chat
#Porn0days
#g-b-w
#misq
#tv-europe
#Anime-Heaven
#extreme-moviez
#underground
#ps2-gaming-zone
#DX-FREAKZ
#mp3-xdcc
irc.tsk.ru
7775
#radik
#ls1
#glazov
#romantic
#ruschannel
#sevntu
#ilyichevsk
#hostels
#patriot
#arena
#sex
irc.saltek.net
7000
#TMD-MOVIEZ
#dj-zone
#movie-madness
#mp3-madness
#porn-r-us
#speedywarez
#vcd-xdccz
#MMX
#iso-haven
irc.scoobynet.org
6667
#east
#Help
#chatzone
#pwhs
#lobby
irc.serbiancafe.ws
6666
#zver
#kragujevac
#35+
#politika
#Serbianteen
#novipazar
#services
#clubyu
#beograd
#SERBIANCAFE
#krajina
irc.sexnet.org
6667
#mp3_zone
#xxxpasswords
#cocks-n-sluts
#group-sex
#porn-r-us
#jacuzzi
#SexpicsFservers
#Teensex
#cocksuckingwhores
irc.shadowfire.org
6667
#durban_otaku
#wow
#obc
#pickup
#enigma
#xs
#ze
#zagamers
#Chicks-Rule
irc.syrolnet.org
6668
#GhostHouse
#SaSSer
#Sky
#survivor
#sky-tek
irc.thundercity.net
7000
#asp
#thundercity
#conceptart
#triviaworld
#L33TWaReZ
eu.undernet.org
6667
#braila
#filipino
#moviestogo
#Zurna
#divx-xxl
#mp3_collective
#Colentina
#istanbul
#tfstcox
#bucuresti
#zalau
irc.unionlatina.org
6667
#Peru
#sexo
#pucusana
#latinos
#Beginner
#BlackHole
irc.unreal-irc.net
6667
#mp3dance
#file-tropolis
#mp3-dance
#movieland
#filecity
#unreal-warez
eu.undernet.org
6667
#fear
#Bauru
#tuba
#wsbr
#brasil
#Safadas
#uberaba
#ShellCO
#abel
#kachu
#cyber
irc.webchatting.com
6668
#x-warez
#music-city
#MP3-HEAVEN
#murder-inc
#iso-music
#gz-#warez
irc.webchat.org
6669
#uptown
#klsex
#Rock
#maroc
#root
#kampung
#Riot
#IdleRPG
#eropah
#garden
#movies4u
irc.whatnet.org
6667
#WhatNET
#unlagged
#pulse
#maddox
#fuckmaddox
#yahoo_games
irc.msinternals.net
6667
#windowsxp
#404
#city-chat
#mp3galaxy
#canuksoft
#XFACTOR
irc.xtasy-chat.net
6667
#precious
#mp3xtasy
#warez
#xdccentral
#worldofdvds
#xdcc-warz
irc.zurna.net
6667
#35+
#adana
#zurna
#islam
#ayva
#ayna
#sex
#gay
#istanbul
#izmir
#ensest
irc.unerror.com
6667
#ao-clan
#redz
#lobby
#network
irc.quicknet.nl
6667
#holland
#triviantplein
#algemeen-ops
#bowey
#gerbera-radio
#inekes-roddelroom
#vriendschap
#leukchatten
#idols_boris
#idols_jim
#radiorambo-zwijndrecht
irc.overdriveirc.net
6667
#zle
#OTB-XDCCZ
#dvdworld
#unique
#warezxpress
#krista
#CONTRA
#boogie*ps2
#destruction
#warezit@
#sopranos
irc.rezosup.org
6667
#enst
#ec-lille
#sherwood
#fossoyeurs
#gniak
#linux
#eclair
#enssat
#bdi
#fleming
#buressudcity
irc.sorcery.net
9000
#conclave
#buaya-family
#idlerpg
#moero
#BrotherhoodRO
#auroro
#mlf
#vtes
#sozphobie
#lineagewc
#kadero
irc.spacetronix.net
7000
#Gotti
#Linux
#UBG-Chat
#SpaceTronix
#wiseguyz
#muh
#UBG-Servers
#Peppis-Channel
#niedersachsen
#Help
irc.spidernet.org
6668
#freeworld
#girlpower
#linux
#idlerpg
#spidernet
#opers
#Radio
#tlc
#porphyria
#trivia
irc.staff-chat.net
6667
#cheatland
#neuewelt
#sdv
#hyruhe
#nwstaff
#lobby
#help
irc.starchat.net
7000
#autistichat
#a-chat
#bodybuilding
#american-politics
#40plus
#14th.org
#broken_Dagger
#30-60_friends
#40s50s4Fun
#12step4coes
#bd_ooc
irc.starfusion.org
6668
#zimmy
#love
#RADiO-FUSiON
#dragonbasic
#ftp-recruits
#invaderzim
#myspleen
irc.starlink.org
6667
#crickettalk
#cricinfo
#cricket
#retardtraffic
#banglacricket
#pixels
irc.stormdancing.net
7000
#storm2k
#Wolf-Dreaming
#TriviaMaster
irc.tevhid.net
7000
#sorucevap
#ummet
#tevhid
#islamiyet
#marmara
#nida
#Kelebek
#mercan
topircnet.com
6667
#coolirc
#chat
#help
#irssi
#salon
#computers
irc.uaap.net
6664
#filipino-chinese
#cksc
#manilamp3
#bookz
#pinoyvidz
#ateneo
#g.c.h.s.
#ALL-MOVIES
irc.underz.org
6668
#0day
#audiowarez
#Radio
#z
#montreal
#help
irc.virtualife.com.br
6667
#fear
#aBuZaDoS
#pingusos
#reef
#open
#MegaShell
#sharkrock
#tuba
#Stanley
#Digratis
#action
irc.voila.fr
6667
#lumiere
#albi
#PremiuM
#Naika
#Metal
#windrop
#rasta
#scripting
#anaheim
#lol
#frisson
207.234.135.147
6669
#movies&music
#thunderhacker
#watnet
#BotLoaning
apophis.zanet.org.za
6667
#hang-out
#cape_town
#herzlia
#kdl
#mp3
#hottub
#durban
#india
#gaysa
#rave
#dagga
irc.zirc.org
6662
#monitor
#istanbul
#octeams
#tfm
#AMV
#kalandozok
#zurna
#idlechan
#pimpslord
#mechg
#ZiRC

The nicknames consist of one of the following:
adams
allen
allison
alvarez
andrson
andrews
armsong
arnold
avila
bailey
baker
barnes
bennett
bishop
boyd
bradley
brooks
brown
bryan
burke
burton
butler
campbell
carlson
carr
carter
chase
chen
christ
clark
collins
comer
cook
cooper
cox
crawford
cunnin
davis
day
dean
dickins
edwards
elliott
ellis
evans
fischer
fisher
fong
ford
freeman
frost
garcia
gardner
gomes
gomez
gonzales
graham
green
griffin
mymoon

Followed by one of the following:
Fight
Fool
Foremos
Frien
Gargar
Gere
Grai
Grant
Grenic
Guneu
Gygae
Gyrti
Gyrto
Haem
Herm
Her
Hono
Honour
Hours
Hyads
Hyperik
Hyperk
Hypse
Hyppyle
Hyria
Hyrmine
Hyrtacus
Hyrtius
Iaera
Ialmenus
Iamenus
Ianassa
Ianeira
Iapetus
Iardanus
Iasus
Icarian
Idaeus
Ides
Idomens
Ielysus
Ilioneus
Ilithuia
Ilithui
Ilius
Ilus
Imbras
Imbrius
Imbros
Imbrus
Insolen
Laodame
Leonte
Lesbia
Lesbos
Lethus
Leto
Leucus
Lycian
Lycians
Lycomed
Lycon
Lycophon
Lycoph
Lyctus
Lycur
Maera
Magnetes
Makar
Mantinea
Maris
Marpsa
Mases
Mastor
Melappus
Manthus
Menheus
Menehius
Menoius
Menon
Mentes
Mydon
Mygdon
Mynes
Myrine
Myrm

The messages it sends are:
want hot chix as ur screensaver? be sure to visit my private server while im on..
everyone interested in the newest cracks can visit my private server while im online.. there's other things on it too
download Britney Spears virual girl screensaver at my private server while im online..
see funny video of naked Bush while his drunk
download new version of Windows XP 2004 Keygen here
hey I found hot Britney Spears Dance Beat screen saver.. download on
Shakira Dancing virual girl , visit my private server while im online...
J-LO Nude (REAL!!) ScreenSaver :) hehe, visit my page
everyone interested to see new Ana Kurnikova hot ScreenSaver can visit my private server while im online.. there's other things on it too
you can download new 2004 Alicia Silverstone Nude screen saver at this page
i have big list of XXX passwords at my private server..you can see while im online
i have big list of URL porn Movies at my private server..you can see while im online
i have big list of URL porn Pics Gallerys at my private server..you can see while im online..there's other things on it too
download new version of Microsoft Office XP (english) key generator here
i have new version Microsoft Office XP (english) key generator at my private webserver , you can download it while im online ;) here
new version of WinZip + crack , you can download at my webserver while im online ;)
new version of AVP crack , you can download at my webserver while im online ;)
new version of miRC crack , you can download at
hey ppl new version of N0RT0N ANTI-VIRUS 2004 (by mymoon) crack ,download here
ppl who need Nero Burning ROM v5.5.8.2 Keygen and muck more new cracks can download here
ppl new private warez server , all new cracks .. see..
hey dowload FREE nude screensavers here
hey download FREE new 2004 ScreenSavers and much more..
hey see this private server.. cool download list..
best virual girls and cracks on net .. only at my private server :)
download hot virual girls from my private webserver , while im online...
download new cracks and screensavers from my private webserver , while im online...
hey ppl new worm on net, named 'i-worm.mymoon' you can download patch from my private server , while im online...
ppl download remove tool for new worm 'i-worm.mymoon' you can download here , while im online...
the antivirus company Sophos released a remove-tool for 'i-worm.mymoon' a new worm thats spreading fast on the internet.. protect your computer.. you can download it from me
the antivirus company Sophos released a remove-tool for 'i-worm.mymoon' a new worm thats spreading fast on the internet.. you can download here
ppl the anti-virus.com company released a remove-tool for 'i-worm.mymoon' a new worm thats spreading fast on the internet.. at my private webserver , you can download it while im online ;) here
who need new cracks and cool p-o-r-n screen savers go to my server...
i update my private server now.. add more cracks and lists,you can see here
my private server is updated now , you can download some new crack and screen savers and muck more.. visit
HELLO PPL hehee i update my private server today , add some new cracks and p-o-r-n lists .. visit :)
I ADD NEW XXX password list on my private server , you can download here
I ADD NEW p-o-r-n password list on my private server , you can download here
new virual GIRLS is now on my server :) you can download one or something else
Cracks and muck more programs and screensavers..FREE download
J-LO Nude (REAL!!) new septembar 2004 ScreenSaver :) hehe, visit my page
J-LO Nude (REAL!!) ScreenSaver :) hehe, visit my page
J-LO Nude 2004 Virual Girl:) visit page and download..
Britney Spears virual girl screensaver NEW VERSION download here
Shakira Dancing 2004 screen saver , download from this private server
want hot chix as ur screensaver? like J-LO or Britney Spears ?? download here
ahhaa funny video of naked Bush while his drunk hehe see here
FREE porn
FREE XXX passwords
FREE Screensavers
FREE XXX Screensavers
FREE cracks
Best warez site
BEST online crack downloads
Humor download
Nude screensavers
FREE virualgirls download
i-worm.mymoon remover
private server
Backdoor to private warez server

It will then append a web address to the end of those messages.

Well Syzop, have fun :)

WOW. That's quite a list... Anywho, I'm sure this means we could probably just sqline all the possible combinations of those nicks and problem solved . Though........

I added the 4 forgotten names to the list, it should now work "100%" :p.
http://www.vulnscan.org/UnrealIrcd/modu ... l#antimoon

(I wasn't in the mood to split the names up into 2 seperate lists, this should work fine already because of some other techniques ;p).

sorry to drag this up after such a long time, but we are unable to get the module to work, it compiles and appears in the /module list, however it doesn't gline any of the bots.

Could you paste some /whois's? :p

sorry about the time it has taken to reply - I was away for the weekend

here are some of the combinations that I have tried, I connected to a standalone server with these details, for testing, the details were taken from bots that connected to our main network

[nick:] Masesfong
[host:] ~Mases@***** (fong3623)

[nick:] Mastorbarnes
[host:] ~Mastor@***** (barnes4701)

[nick:] Hermfisher
[host:] ~Herm@****** (fisher5836)

Here are the whowas's of the actual bots that connected to the main network-to show that there was no typos...

Masesfong was [email protected] * fong3623
End of WHOWAS
Mastorbarnes was ~[email protected] * barnes4701
End of WHOWAS
Hermfisher was ~[email protected] * fisher5836
End of WHOWAS

and finally on a /module ....
25/10 - 1306] [Notice] *** antimoon (MyMoon trojan detector by Syzop) [3RD]

It only detects the real bots. So if you try to connect with mIRC (and probably most other common clients) it won't detect them as bots. Obviously this is a good thing since it limits false positives to like near-zero percent.

So, did you load the module on your live net and did you see it in fact not-detecting any bots? (note: it detects them on-connect, so any existing bots are unaffected).

I didn't realise it only detected the real bots and not mirc clients faking them, obviously it breaks any test server we have to try to do so, although it does show that normal clients arn't zlined.

I have since started installing it on the real network and it appears to be working fine.

Sorry for the mistake, thanks for your help

it appears that these two nicks are missing from the list...ljudov and iudsf


[2122] <exonic> [12:43] * Myrmljudov (~[email protected]) has joined #monitor
[2122] <exonic> [12:43] <Myrmljudov> Nude screensavers http://81.93.88.79:7788/
[2122] <exonic> [12:43] * Myrmljudov (~[email protected]) Quit (User has been banned from ZiRC (Automatically killed: Reason: Joined banned channel - Contact [email protected] for help. ID: kc401d9e1f))

[1401] <exonic> are you there?
[1401] <exonic> got another hit:
[1401] <exonic> [05:56] * Ilithuiiudsf (~[email protected]) has joined #monitor
[1401] <exonic> [05:56] <Ilithuiiudsf> who need new cracks and cool p-o-r-n screen savers go to my server... http://81.93.88.80:6666/
[1401] <exonic> [05:56] * Ilithuiiudsf (~[email protected]) Quit (User has been banned from ZiRC (Automatically killed: Reason: Joined banned channel - Contact [email protected] for help. ID: kc401d9e1f))

That must be some variant then, since (something with) judov (in it) is not present in the trojan I analyzed, nor in the namelist codemastr pasted.
'iudsf' doesn't really sound like a name either (not present either btw).

Unfortunately both (virus-)URLs no longer seem to be working, so I couldn't grab a copy... If you get some of those undetected ones again, feel free to mail me (yes, mail) at syzop AT unrealircd DOT com.

Btw, did you notice the spamfilters mentioned in this thread? you can use them too, just as a 2nd layer of defense :).

i removed the spamfilters that we used previously as i thought they were unncessary, instead of readding the spamfilters i set an qline on the two nicks as this is simpler. If i see any more i will try to grab the file.

It wouldn't surprise me if the owner is updating them with a few additional nicks every now and then, it is probably possible, as when a few people went to the net where he was initially collecting them he implied that he could gain more access to them besides the server that is broadcast on irc

heya all, long time listener, first time caller

im not sure if this board allows solutions of this type (its a mirc script, dont groan, it works.) but ive been handling this problem since they first started appearing on irc.bdsm-net.com and i seem to have been able to handle them very well.

after seeing the first one, i downloaded the vector and infected a sandbox machine to extract any information i could, and found basicly the same as you guys, its a simple detection method. once i had the list of nicknames, i made the attatched mirc script (should be fine in mirc 6.X and above) and fed it in the attatched list. since then, as each new strain has been released, ive simply downloaded it, re-infected the sandbox machine, and extracted the nicklist, to the current list i have today.

it seems to catch all the bots, and is simple to use. i run it in my personal copy of mirc without any side-effects (aside from a few seconds at startup as it loads and multiplies the lists).

i origonally tried adding a line for each individual nickname variation, but as my current database is at 24649 possible nicknames, obviously thats not feasible anymore.

i have put the script here : http://zidane.redirectme.net/spamkiller.mrc

and the current nickname list here : http://zidane.redirectme.net/spamnicks.txt


the script is a quick hack, and is not my best code by far (to be honest, it was a quick fix, but its working very well, and if it aint broke, i dont try to fix it). if you think you can improve the code, then by all means do so, it will save me a job

as for using the script. its pretty simple. load it into mirc as you would any other script. if you place the "spamnicks.txt" file in the *same location* as the script, it will automatically load the nickname list from that, or you can use the command: /spamkiller.makelist to locate the list of nicknames manually. once the script has a list (it will take several seconds to multiply the list) then it will listen to the snotices and ban any bad nick it sees.

a few words of caution. the script is known to work on unreal beta17 (thats the one we run on irc.bdsm-net.com and it is known to work in mirc 6.14, with any other versions, i cannot garuntee success, but if you know any mirc scripting, its easy enough to change the script.

basicly, it just loads the nickname list, creates a second list containing every possible combination, then watches the connects for any nicknames matching it. whilst this combination generation does take several seconds during the scripts loading, it means the connects can be checked with a single lookup and minimal code. it has been proven to work, and for those of us who dont have the benefits present in unreal3.2, it is one solution.

[moderator: Please do not post links to adult-only networks here]

hopefully this will help towards a solution to the problem, if this is not the place for this type of post, or if there are any problems with posting mirc script solutions rather than unrealircd based solutions, please drop me a note and i will be happy to address any concerns.

happy hunting

`Zidane.


--

you dont need a reason to help people. `Zidane Tribal.
[/url]

I believe theres a newer version of this virus out now, some names are slipping through the cracks. I'll attempt to get hold of it and see what can be added

Hi,

I have these bots and a spamfilter seems to do the trick for me. For Unreal3.2.3


spamfilter add u block - - (^[A-Z]{1}[a-z]{6})([a-z]{6})!\1@.+:\2