Spamfilter Help... - DCC send secrets.exe
Spamfilter Help... - DCC send secrets.exe
Hey guys, I needed some help writing a spamfilter to gline bots which are connecting and attempting to send 'secrets.exe' to users.
I tried:
spamfilter {
regex "secrets\.exe";
target dcc;
action gline;
reason "Code 200 - Your client is generating spam which disrupts network. Please visit http://www.epicirc.net/kline or email [email protected] for more information.";
ban-time 72h;
};
But that didn't work. Any ideas?
Thanks.
I tried:
spamfilter {
regex "secrets\.exe";
target dcc;
action gline;
reason "Code 200 - Your client is generating spam which disrupts network. Please visit http://www.epicirc.net/kline or email [email protected] for more information.";
ban-time 72h;
};
But that didn't work. Any ideas?
Thanks.
- Darvocet
Sr. Network Admin: EpicIRC.Net
Sr. Network Admin: EpicIRC.Net
[Spamfilter] euuoiu![email protected] matches filter 'secrets\.exe': [PRIVMSG [NEдетский_STYLE]PeppEr: 'secrets.exe'] [secrets exe spammer]
:]
/spamfilter add d gzline 30d secrets_exe_spammer secrets\.exe
:]
/spamfilter add d gzline 30d secrets_exe_spammer secrets\.exe
wax wrote:[Spamfilter] euuoiu![email protected] matches filter 'secrets\.exe': [PRIVMSG [NEдетский_STYLE]PeppEr: 'secrets.exe'] [secrets exe spammer]
:]
/spamfilter add d gzline 30d secrets_exe_spammer secrets\.exe
Neither of those worked...
[2:55pm] -Groofy- DCC Send secrets.exe (82.73.70.x)
Any other ideas?
- Darvocet
Sr. Network Admin: EpicIRC.Net
Sr. Network Admin: EpicIRC.Net
Thank you Syzop for your help. I didn't allow it on my client so didn't even think of that. Doh!Syzop wrote:That's just a notice, not the actual DCC.
Umm.. yes I added it to all servers and rehashed. This is my third day. So the file is now blocked by the dcc deny field. What is the best way to go about glining them for trying? I did add a spamfilter:
(%) F d gzline 0 72853 259200 Code_200_-_Your_computer_is_infected_with_a_virus._Please_visit_www.epicirc.net/kline_for_more_information. XanaX![email protected] secrets\.exe
But that didn't work in our test... I'm going out of town today so I will post again and try to get this done tonight when I get to California.
Thanks!
- Darvocet
Sr. Network Admin: EpicIRC.Net
Sr. Network Admin: EpicIRC.Net
Code: Select all
spamfilter {
regex "secrets\.exe";
target { private-notice;};
action gline;
reason "Code 200 - Your computer is infected with a virus. Please visit www.epicirc.net/kline for more information.";
bantime 72h;
};
-
- Posts: 59
- Joined: Sun Jun 20, 2004 3:30 am
- Contact:
Technically, DCC is a CTCP, but so is ACTION (like '/me is teh leet').
I don't know where you're after, but if what you meant was if you ignore all ctcps, if you would then also be ignoring DCC? The answer is: it depends on the client. On some (or many) DCC CTCP's are not included in CTCP ignore (which is quite logical). Also ACTION CTCP's are almost never included in CTCP ignore.
Reminds me of those old times where BitchX would kickban or take other actions whenever someone used /me too much, seeing it as a 'CTCP flood' ;)
I don't know where you're after, but if what you meant was if you ignore all ctcps, if you would then also be ignoring DCC? The answer is: it depends on the client. On some (or many) DCC CTCP's are not included in CTCP ignore (which is quite logical). Also ACTION CTCP's are almost never included in CTCP ignore.
Reminds me of those old times where BitchX would kickban or take other actions whenever someone used /me too much, seeing it as a 'CTCP flood' ;)
-
- Posts: 59
- Joined: Sun Jun 20, 2004 3:30 am
- Contact: