MyMoon (Was: new threat)

aquanight · Post by **aquanight** » Fri Sep 24, 2004 2:47 am

If he were to tell, the bot coder need only look here, change the bot and the module becomes broken...

Stealth · Post by **Stealth** » Fri Sep 24, 2004 4:52 am

Same goes for just looking at the module source

And Syzop has my email too

Cheese · Post by **Cheese** » Sat Sep 25, 2004 12:44 am

If the bot maker does come here, Big deal, we'll just find other ways of preventing it from happening, Besides its either this or we put up with the constant spamming in our networks

Stormdancing · Post by **Stormdancing** » Mon Sep 27, 2004 3:54 pm

LOL

Will install this tonight and report back with my results.

Dana
Stormdancing

Guest · Post by **Guest** » Tue Sep 28, 2004 3:43 am

Installed and slamming spammer worms right and left. So far no real users caught in the trap or any apparent problems.

Thanks Syzop!

Stormdancing · Post by **Stormdancing** » Tue Sep 28, 2004 3:45 am

Guest was me.

Sorry

Post by **Syzop** » Tue Sep 28, 2004 7:11 pm

Good. And yes, normal users have a very low chance of being caught accidently (in fact, it's near 0.0%).
(also ->stealth) Let's not get into too much details ;).

I've only had positive reports, so I'm confident that it works just fine.

Stealth · Post by **Stealth** » Wed Sep 29, 2004 6:00 am

Syzop, will this modue be added to the Win32 module pack? (unless it has been already) And if it is not already in the Win32 module pack, when will it be added? (so I can add it to the Win32 module site until it is added to the module pack)

Post by **Syzop** » Wed Sep 29, 2004 2:07 pm

I'm not sure if this worm is active on any unrealircd win32 nets.
If someone on those nets is affected, they can mail me of course.
I'm not always in the mood to compile and package a mod for 2 unreal versions etc ;).

Stormdancing · Post by **Stormdancing** » Fri Oct 01, 2004 8:24 pm

This worked great but now today they are slipping through.
I wonder if they have changed their tactics? Did I miss something?

[14:35] * Joins: Iamenusbradley (~[email protected])
[14:35] <Iamenusbradley> i have new version Microsoft Office XP (english) key generator at my private webserver , you can download it while im online

here http://195.250.104.27:1100/
Iamenusbradley was ~[email protected] * bradley6941
Iamenusbradley using StormDancing.Edison.NJ.US.StormDancing.Net Fri Oct 1 12:37:38 2004
End of WHOWAS

[15:16] * Joins: Gargardean (~[email protected])
[15:17] <Gargardean> who need new cracks and cool p-o-r-n screen savers go to my server... http://192.168.1.97:8000/

Gargardean was ~[email protected] * dean1622
Gargardean using Heartsfire.Larkspur.CO.US.StormDancing.Net Fri Oct 1 13:18:58 2004
End of WHOWAS

pak · Post by **pak** » Fri Oct 01, 2004 11:50 pm

it looks like the owner has updated the nick list

[edit] it isn't new, a few were just missed....

bradley
bishop
dean
boyd

[/edit]

w00t · Post by **w00t** » Sun Oct 03, 2004 12:20 pm

Perhaps so, but one that was mentioned as "getting through" is in the nicklist.

Stormdancing, check the module is loaded... on all servers... etc etc etc.

pak · Post by **pak** » Sun Oct 03, 2004 2:26 pm

neither dean or bradley are in the nicklist that the module holds, those are the two examples you gave, I would be interested to see what nick that was on the list got through

w00t · Post by **w00t** » Mon Oct 04, 2004 12:56 pm

[14:35] * Joins: Iamenusbradley (~[email protected])
[14:35] <Iamenusbradley> i have new version Microsoft Office XP (english) key generator at my private webserver , you can download it while im online Wink here http://195.250.104.27:1100/

^^ from the post before.

pak · Post by **pak** » Mon Oct 04, 2004 2:34 pm

I have searched the module source again and there is no reference to bradley. You require both nicks to be in the list for a match to be made

UnrealIRCd Forums

MyMoon (Was: new threat)

Syzop, have I told you lately that I love you?