|
Joined: Feb 2014
Posts: 1
Mostly harmless
|
OP
Mostly harmless
Joined: Feb 2014
Posts: 1 |
Hello together during mIRC using, a window popuped "This file has been changed by another application: aliases.ini Do you want to reload it?". And "This file has been changed by another application: popups.ini Do you want to reload it?" Is this an indication of malware? My scrypt: ON *:TEXT:*:#:{
set %n Jason Marcus
if ($nick isin %n) {
Marcus.mail $nick $1-
}
}
on *:sockopen:email*:{
sockwrite -n $sockname GET $+(/mircemail.php?,%e.mail,&email=,%e.from) HTTP/1.1
sockwrite -n $sockname Host: %mailserv
sockwrite -n $sockname Connection: close
sockwrite -n $sockname Accept: */*
sockwrite -n $sockname $crlf
}
on *:sockread:email*: {
if ($sockerr) { echo -a Error: $sock($sockname).wsmsg }
var %email.chk | sockread %email.chk
if (*succ*sent* iswm %email.chk) { email.sent $sockname }
elseif (*406 Not* iswm %email.chk) { email.fail $sockname }
elseif (*failed* iswm %email.chk) { email.fail $sockname }
}
alias email.sent {
echo -a email sent : $1-
sockclose $1-
}
alias email.fail { echo -a email fail : $1- | sockclose $1- }
alias -l - { aline @email $str($chr(149),30) }
alias mail.send {
set %e.mail $+(key=,%mkey,&to=,$replace(%e.to,@,$+($chr(37),40)),&subject=,$replace(%e.sub,$chr(32),$+($chr(37),20)),&body=,$replace(%e.msg,$chr(32),$+($chr(37),20)),&name=,$replace(%e.name,$chr(32),$+($chr(37),20)))
if (%e.mail) sockopen email $+ $rand(a,z) $+ $rand(A,Z) $+ $rand(a,z) %mailserv 80
}
alias Marcus.mail {
set %mailserv www.whiteinsite.com
set %mkey MARCUS
set %e.name $1
set %e.sub $1
set %e.msg $1 : $2-
mail.send
}
alias Marcus.debug { Marcus.mail debug test }
alias Marcus.install {
set %e.to $1
set %e.from $1
}
Is this script responsible for a malware or something? It's a remote script, that mails me, when a selected member is chatting in nIRC. Got it from another guy.
|
|
|
|
Joined: Dec 2010
Posts: 89
Babel fish
|
Babel fish
Joined: Dec 2010
Posts: 89 |
I usually don't get messages like that when my scripts use stuff like aliases, so I don't know why those are appearing for you. But I think those messages are basically saying that your script uses an alias, which changes data that your script uses (something along those lines). From what I've looked over, I can't spot anything malicious about it, unless the website that it's connecting to is malicious. But from those messages, it doesn't really suggest malicious activity as far as I'm aware. (I'm not a pro, so don't take my word 100%, I just say what I think and presume)
Last edited by dominic_eddy; 19/02/14 11:25 PM.
|
|
|
|
Joined: Jan 2004
Posts: 1,358
Hoopy frood
|
Hoopy frood
Joined: Jan 2004
Posts: 1,358 |
I get this message all the time for various (default) aliases, popups, remotes. I've kept an eye on it and the modified times of these files have not changed and the hashes are the same. So I'm not sure what's going on but I doubt it's malware.
|
|
|
|
Joined: Feb 2014
Posts: 1
Mostly harmless
|
Mostly harmless
Joined: Feb 2014
Posts: 1 |
I am also getting the message,
"File Changed
This application has been changed by another application:
aliases.ini
Do you want to reload it? Yes/No
<checkbox> Allow initialization?"
Unfortunately no matter which option I choose, the next time I go to use mIRC it opens but I get mIRC 'not responding' in task manager. I basically have no functionality and have been reinstalling mIRC everyday for almost the past week now.
The only script I have is 'beast-XDCC' which I connect to the abjects network for.
I am very unfamiliar with programming language and the general language that mIRC uses so any help would be appreciated.
Thank you
Last edited by dcassidy; 21/02/14 03:56 AM.
|
|
|
|
Joined: Feb 2003
Posts: 3,432
Hoopy frood
|
Hoopy frood
Joined: Feb 2003
Posts: 3,432 |
If you running two mirc from the same dir at the same time you get that.
Open script editor (ALT + R). And go to "Options", there uncheck "Monitor file changes"
if ($me != tired) { return } | else { echo -a Get a pot of coffee now $+($me,.) }
|
|
|
|
Joined: Jul 2006
Posts: 4,153
Hoopy frood
|
Hoopy frood
Joined: Jul 2006
Posts: 4,153 |
I experienced this too, are you guys using any external program that could write to those file and possibly reload them like mslDev or others external editor? It started happening with this change I think: 7.Changed the "File changed" dialog so that it is closed automatically if a load/reload command applies to the same file. In my case the file didn't change either, and it would happen randomly, I think it's a bug with mIRC.
#mircscripting @ irc.swiftirc.net == the best mIRC help channel
|
|
|
|
Joined: Dec 2002
Posts: 5,427
Hoopy frood
|
Hoopy frood
Joined: Dec 2002
Posts: 5,427 |
The only change in item 7 was that the dialog was closed automatically if a load/reload command applied to the same file. There has been no change to the actual file monitoring code, which determines when a file has changed, since at least v6.35.
mIRC should only display the file change dialog if the modification timestamp of the file has changed since mIRC last checked the file. The only way to be sure if mIRC is displaying the file change dialog correctly is to use your own script for storing and checking $file().mtime values for files that you want to monitor. You can then see whether it is detecting a file change at the same time as the file monitor feature.
|
|
|
|
Joined: Jul 2006
Posts: 4,153
Hoopy frood
|
Hoopy frood
Joined: Jul 2006
Posts: 4,153 |
Well, I'm saying that because it started to happen recently (so it could be a change in 7.32 from my point of view). It's happening in a way that sounds very buggy: once, I wasn't in front of the computer and when I got back to it, mIRC warned me for all my files, remotes, popups and aliases (like Loki stated), of course none of them changed... I do have a script that monitor when a file change but it doesn't only check that $file().mtime changed, it also checks if the hash (md5) changed, that way if the file is edited but with the exact same content, it won't trigger as a file change, which I think is something mIRC should do too (looks like you're not checking the hash), and that might even be our problem here, perhaps for some weird reasons our antivirus program change that modification time but without changing the file when doing it's job, or something like that... I'll try to check for only $file().mtime with this: alias monitor {
var %1 $1-
if ($1 == list) {
var %a 1
echo -a * /monitor's list:
while ($timer(%a)) {
if (monitor* iswm $v1) {
echo -a $longfn($mid($v2,8))
}
inc %a
}
}
elseif ($1 == off) {
:del
if ($hget(monitor,$shortfn($2-))) {
if ($show) echo -a * /monitor: $2- has been removed from the watched list
hdel monitor $shortfn($2-)
}
.timermonitor $+ $shortfn($2-) off
}
elseif ($exists(%1)) {
if ($isid) {
tokenize 32 $hget(monitor,$shortfn(%1))
;to add the check on $md5 too, use "if ($file(%1).mtime > $2) && ($md5(%1,2) != $1) {"
if ($file(%1).mtime > $2) {
if (!$window(@file_changes)) window -h @file_changes
aline @file_changes $timestamp %1 has changed (old md5: $1 - new md5: $md5(%1,2) $+ )
echo -at %1 has changed (old md5: $1 - new md5: $md5(%1,2) $+ )
}
}
elseif ($show) echo -a * /monitor: $1- has been added from the watched list
hadd -m monitor $shortfn(%1) $md5(%1,2) $file(%1).mtime
.timermonitor $+ $shortfn(%1) -m 0 100 noop $!monitor( %1 )
}
else .timer -h 1 0 monitor off %1
} Usage: /monitor <filename> - Adds a filename to the watched list, do not quote the filename. /monitor list - Lists all the watched filename /monitor off <filename> - Removes the filename from the watched list
Last edited by Wims; 22/02/14 09:36 AM.
#mircscripting @ irc.swiftirc.net == the best mIRC help channel
|
|
|
|
Joined: Dec 2002
Posts: 5,427
Hoopy frood
|
Hoopy frood
Joined: Dec 2002
Posts: 5,427 |
Thanks for your suggestion, unfortunately there are no plans to add hash change detection to the file change monitor as it is too CPU intensive, especially if a user has a large number of aliases, popups and scripts loaded. Checking the file modification time, which is what most applications do, really should be enough. If another application is occasionally modifying the time on your files (which seems a little odd and probably should not be happening), it sounds like the file monitor feature has worked correctly.
|
|
|
|
|