mIRC Home    About    Download    Register    News    Help

Print Thread
#148242 01/05/06 07:14 PM
Joined: Feb 2005
Posts: 185
S
Vogon poet
OP Offline
Vogon poet
S
Joined: Feb 2005
Posts: 185
hi guys,

This is my problem, on my server that I run there are a few nicks from time to time that I would like to remove permantly, for example:

Code:
   
36shjks
jadsklj324r12
s23


so instead of glining them all the time, is there a way to remove/ban random nicks everytime they try to connect?

any help would be great!


sub-zero.homeip.net:6667

Joined: Aug 2005
Posts: 525
S
Fjord artisan
Offline
Fjord artisan
S
Joined: Aug 2005
Posts: 525
That would be fairly difficult to do automatically unless there is some kind of pattern that the nicks use. e.g. they all have two numbers at the end.

Joined: Feb 2005
Posts: 185
S
Vogon poet
OP Offline
Vogon poet
S
Joined: Feb 2005
Posts: 185
that I can understand, but maybe, when the nicks use a certain amount of charaters, so a nick with only 3 characters, ie "cha" it would stop them using it, something or prehaps any nick that connected using only 1 charactor, or mainly a nick starting with numbers, ie, 12char, then it would akill them.


sub-zero.homeip.net:6667

Joined: Aug 2005
Posts: 525
S
Fjord artisan
Offline
Fjord artisan
S
Joined: Aug 2005
Posts: 525
The problem with your suggested solution is that if you remove all users with 3 letter nicks, you are potentially removing 'good' users. The same goes for nicks of any other length.

And can I ask what server are you on that allows numbers at the beginning of a nick? I've never come across a server where that was possible.

Joined: May 2006
Posts: 25
A
Ameglian cow
Offline
Ameglian cow
A
Joined: May 2006
Posts: 25
Well, the net I'm connecting to has a similar problem, with the diference they're not a few, but about a thousand per day (a thousand only in my channel) smile

I don't know if it's the same kind of bots, because you specified the nicks with numbers, and we usually don't have bots with numbers on nicks. There are 2 kind of bots. Both are supposed to belong to the same creator (a turkish guy), and he uses web pages and P2P to infect people with a kind of virus, that runs mirc on their computer (of course, they don't know they are running it), with a script that makes spam, and tries to infect more people with it.

The first kind of bot uses nicks like these, I'll paste the 10 last bots I kicked:

rybkkl, ucfm, dyiwfl, yjqwdu, vtbgcv, ebvl, ekbbgyknd, jgltcrdun, smawrq, svdbfdhed... and so on.

The other ones use more sophisticated nicks, maybe from some net in Turkey, and joins with nicks like:

^^ebru^^, AZEP, Guest11329, SESSIZHAYAT, ^^pc^^kolog^^, Hotel_Ca-liforn, murat_-, ANTALY35M, SoNsUzLuGuN_GoL, AHMET-TURAN-40M...

However, I made a script that detect both kind of bots, and kick them, adding their host to a Hash table of "blacklisted", so when he tries to join with another nick (they use the same host for many connections, I guess they use proxy servers), I don't make any lookup, directly I kick him. Of course, if the nick rejoin in a short period of time (these bots don't use to), the nick probably is a human, so I remove the host from the Hash table.

It's based on REGEXP ($regex), and detects about 98% of them, and fails (human) about 1 every 50 nicks.

If you paste me the whois of some of these bots, I can determine if my addon would help you or not, and I can tell you how it is made, so you can also ban these annoying bots.

See ya wink

Last edited by Abstract; 07/05/06 11:41 AM.

==================
Abstraction is art.
Joined: Oct 2005
Posts: 1,741
G
Hoopy frood
Offline
Hoopy frood
G
Joined: Oct 2005
Posts: 1,741
If you can give more information about the nicks that you want to get rid of, then we can probably help you better. Provide /whois information (without hidden hosts if possible) and /ctcp version information. Those are pretty much the only way to detect infected machines.

-genius_at_work


Link Copied to Clipboard