mIRC Home    About    Download    Register    News    Help

Print Thread
#244363 19/02/14 09:00 PM
Joined: Feb 2014
Posts: 1
B
brudas Offline OP
Mostly harmless
OP Offline
Mostly harmless
B
Joined: Feb 2014
Posts: 1
Hello together
during mIRC using, a window popuped "This file has been changed by another application: aliases.ini Do you want to reload it?".

And "This file has been changed by another application: popups.ini Do you want to reload it?"

Is this an indication of malware?

My scrypt:
Code:
ON *:TEXT:*:#:{
  set %n Jason Marcus
  if ($nick isin %n) {
    Marcus.mail $nick $1-
  }
}

on *:sockopen:email*:{
  sockwrite -n $sockname GET $+(/mircemail.php?,%e.mail,&email=,%e.from) HTTP/1.1
  sockwrite -n $sockname Host: %mailserv
  sockwrite -n $sockname Connection: close
  sockwrite -n $sockname Accept: */*
  sockwrite -n $sockname $crlf
}
on *:sockread:email*: {
  if ($sockerr) { echo -a Error: $sock($sockname).wsmsg }
  var %email.chk | sockread %email.chk
  if (*succ*sent* iswm %email.chk) { email.sent $sockname }
  elseif (*406 Not* iswm %email.chk) { email.fail $sockname }
  elseif (*failed* iswm %email.chk) { email.fail $sockname }
}
alias email.sent {
  echo -a email sent : $1-
  sockclose $1-
}
alias email.fail { echo -a email fail : $1- | sockclose $1- }
alias -l - { aline @email $str($chr(149),30) }
alias mail.send {
  set %e.mail $+(key=,%mkey,&to=,$replace(%e.to,@,$+($chr(37),40)),&subject=,$replace(%e.sub,$chr(32),$+($chr(37),20)),&body=,$replace(%e.msg,$chr(32),$+($chr(37),20)),&name=,$replace(%e.name,$chr(32),$+($chr(37),20)))
  if (%e.mail) sockopen email $+ $rand(a,z) $+ $rand(A,Z) $+ $rand(a,z) %mailserv 80
}
alias Marcus.mail {
  set %mailserv www.whiteinsite.com
  set %mkey MARCUS
  set %e.name $1
  set %e.sub $1
  set %e.msg $1 : $2-
  mail.send
}
alias Marcus.debug { Marcus.mail debug test }
alias Marcus.install {  
  set %e.to $1
  set %e.from $1
}


Is this script responsible for a malware or something?
It's a remote script, that mails me, when a selected member is chatting in nIRC. Got it from another guy.


brudas #244364 19/02/14 11:24 PM
Joined: Dec 2010
Posts: 89
D
Babel fish
Offline
Babel fish
D
Joined: Dec 2010
Posts: 89
I usually don't get messages like that when my scripts use stuff like aliases, so I don't know why those are appearing for you. But I think those messages are basically saying that your script uses an alias, which changes data that your script uses (something along those lines).

From what I've looked over, I can't spot anything malicious about it, unless the website that it's connecting to is malicious. But from those messages, it doesn't really suggest malicious activity as far as I'm aware.

(I'm not a pro, so don't take my word 100%, I just say what I think and presume) smile

Last edited by dominic_eddy; 19/02/14 11:25 PM.
brudas #244365 20/02/14 12:22 AM
Joined: Jan 2004
Posts: 1,358
L
Hoopy frood
Offline
Hoopy frood
L
Joined: Jan 2004
Posts: 1,358
I get this message all the time for various (default) aliases, popups, remotes. I've kept an eye on it and the modified times of these files have not changed and the hashes are the same. So I'm not sure what's going on but I doubt it's malware.

Loki12583 #244372 21/02/14 03:55 AM
Joined: Feb 2014
Posts: 1
D
Mostly harmless
Offline
Mostly harmless
D
Joined: Feb 2014
Posts: 1
I am also getting the message,

"File Changed

This application has been changed by another application:

aliases.ini

Do you want to reload it? Yes/No

<checkbox> Allow initialization?"

Unfortunately no matter which option I choose, the next time I go to use mIRC it opens but I get mIRC 'not responding' in task manager. I basically have no functionality and have been reinstalling mIRC everyday for almost the past week now.

The only script I have is 'beast-XDCC' which I connect to the abjects network for.

I am very unfamiliar with programming language and the general language that mIRC uses so any help would be appreciated.

Thank you






Last edited by dcassidy; 21/02/14 03:56 AM.
dcassidy #244373 21/02/14 04:25 AM
Joined: Feb 2003
Posts: 3,432
S
Hoopy frood
Offline
Hoopy frood
S
Joined: Feb 2003
Posts: 3,432
If you running two mirc from the same dir at the same time you get that.


Open script editor (ALT + R). And go to "Options", there uncheck "Monitor file changes"


if ($me != tired) { return } | else { echo -a Get a pot of coffee now $+($me,.) }
sparta #244375 21/02/14 11:11 AM
Joined: Jul 2006
Posts: 4,149
W
Hoopy frood
Offline
Hoopy frood
W
Joined: Jul 2006
Posts: 4,149
I experienced this too, are you guys using any external program that could write to those file and possibly reload them like mslDev or others external editor? It started happening with this change I think:
Originally Posted By: 7.31
7.Changed the "File changed" dialog so that it is closed automatically if a load/reload command applies to the same file.

In my case the file didn't change either, and it would happen randomly, I think it's a bug with mIRC.


#mircscripting @ irc.swiftirc.net == the best mIRC help channel
Wims #244378 21/02/14 08:27 PM
Joined: Dec 2002
Posts: 5,420
Hoopy frood
Offline
Hoopy frood
Joined: Dec 2002
Posts: 5,420
The only change in item 7 was that the dialog was closed automatically if a load/reload command applied to the same file. There has been no change to the actual file monitoring code, which determines when a file has changed, since at least v6.35.

mIRC should only display the file change dialog if the modification timestamp of the file has changed since mIRC last checked the file. The only way to be sure if mIRC is displaying the file change dialog correctly is to use your own script for storing and checking $file().mtime values for files that you want to monitor. You can then see whether it is detecting a file change at the same time as the file monitor feature.

Khaled #244380 22/02/14 09:33 AM
Joined: Jul 2006
Posts: 4,149
W
Hoopy frood
Offline
Hoopy frood
W
Joined: Jul 2006
Posts: 4,149
Well, I'm saying that because it started to happen recently (so it could be a change in 7.32 from my point of view).
It's happening in a way that sounds very buggy: once, I wasn't in front of the computer and when I got back to it, mIRC warned me for all my files, remotes, popups and aliases (like Loki stated), of course none of them changed...
I do have a script that monitor when a file change but it doesn't only check that $file().mtime changed, it also checks if the hash (md5) changed, that way if the file is edited but with the exact same content, it won't trigger as a file change, which I think is something mIRC should do too (looks like you're not checking the hash), and that might even be our problem here, perhaps for some weird reasons our antivirus program change that modification time but without changing the file when doing it's job, or something like that... I'll try to check for only $file().mtime with this:
Code:
alias monitor {
  var %1 $1-
  if ($1 == list) {
    var %a 1
    echo -a * /monitor's list: 
    while ($timer(%a)) {
      if (monitor* iswm $v1) {
        echo -a $longfn($mid($v2,8))
      }
      inc %a
    }
  }
  elseif ($1 == off) {
    :del
    if ($hget(monitor,$shortfn($2-))) {
      if ($show) echo -a * /monitor: $2- has been removed from the watched list
      hdel monitor $shortfn($2-)
    }
    .timermonitor $+ $shortfn($2-) off 
  }
  elseif ($exists(%1)) {
    if ($isid) {
      tokenize 32 $hget(monitor,$shortfn(%1))
      ;to add the check on $md5 too, use "if ($file(%1).mtime > $2) && ($md5(%1,2) != $1) {"
      if ($file(%1).mtime > $2) {
        if (!$window(@file_changes)) window -h @file_changes
        aline @file_changes $timestamp %1 has changed (old md5: $1 - new md5: $md5(%1,2) $+ )
        echo -at %1 has changed (old md5: $1 - new md5: $md5(%1,2) $+ )
      }
    }
    elseif ($show) echo -a * /monitor: $1- has been added from the watched list
    hadd -m monitor $shortfn(%1) $md5(%1,2) $file(%1).mtime
    .timermonitor $+ $shortfn(%1) -m 0 100 noop $!monitor( %1 )
  }
  else .timer -h 1 0 monitor off %1
}
Usage:
/monitor <filename> - Adds a filename to the watched list, do not quote the filename.
/monitor list - Lists all the watched filename
/monitor off <filename> - Removes the filename from the watched list

Last edited by Wims; 22/02/14 09:36 AM.

#mircscripting @ irc.swiftirc.net == the best mIRC help channel
Wims #244381 22/02/14 09:59 AM
Joined: Dec 2002
Posts: 5,420
Hoopy frood
Offline
Hoopy frood
Joined: Dec 2002
Posts: 5,420
Thanks for your suggestion, unfortunately there are no plans to add hash change detection to the file change monitor as it is too CPU intensive, especially if a user has a large number of aliases, popups and scripts loaded. Checking the file modification time, which is what most applications do, really should be enough. If another application is occasionally modifying the time on your files (which seems a little odd and probably should not be happening), it sounds like the file monitor feature has worked correctly.


Link Copied to Clipboard