Quote:

My point was that if you wanna make autokicker like:
if (FullEncodedStringHere isin $1-) you will need to update (add new if's) very often... too often... because if even one letter is changed there you dont detect it anymore...


That isnt what i ment, or thought I said,

this is what i ment.
Code:
in a ON *:TEXT:*//write $decode* event
;
  var %write.decode = //write $ $+ decode
  if (%write.decode isin $1-) {
    ;
    var %pre.text = $left($1-,$calc($pos($1-,%write.decode,1) - 1 ))
    var %pre.text.encoded = $encode(%pre.text)
    var %encode.text = $mid($1-,$calc($pos($1-,%write.decode,1) + 15 ))
    ;
    if (%pre.text.encoded isin %encode.text) { kick, ban, yell, throw eggs etc }
;
(this is not debugged of course)


The event goes off, The 1st IF isnt really needed , but might be a * matchtext who knows, anyway.
get the text before the "//write $decode" into %pre.text
encode it into %pre.text.encoded
get the already encoded text sent to you into %encoded.text
Now
See if the %pre.text.encoded is in the %encoded.text, if so then do whatr ya feel needs to be done

If it is just virus line sent to you then the %pre.text.encoded well be in the already encoded text, since that encoded text is the whole script file that just sent you the message, so the text must have been in it.

I well admit it might take some tuning to get that exactly correct, but i havent bothered to keep a copy of the virus.