 need a script to prevent the matrix2 virus
#72274
21/02/04 12:06 PM
|
Joined: Aug 2003
Posts: 22
WRFan
OP
Ameglian cow
|
|
OP
Ameglian cow
Joined: Aug 2003
Posts: 22 |
you certainly know that infamous matrix2 virus. can somebody provide a mirc script that would prevent the chat window with the virus instructions from opening and automatically set the user who sent the message on ignore? otherwise I always have to close that window manually
Last edited by WRFan; 21/02/04 12:06 PM.
|
|
|
|
Re: need a script to prevent the matrix2 virus
#72275
21/02/04 12:31 PM
|
Joined: Sep 2003
Posts: 93
Talea
Babel fish
|
|
Babel fish
Joined: Sep 2003
Posts: 93 |
Use: on ^*:open:?:*: { if (*matrix* iswm $1-) { if ($wildsite !isignore) { ignore -u20 $wildsite } var %i = $comchan($nick,0) echo -s 4,1 *** $nick ( $+ $address $+ ) message'd you saying:8 $1- haltdef } dec %i } What this will do is never open the msg window, ignore the user for 20 seconds and echo the msg he sent to your status window - if you do not wish to see the echo just take out the echo -s line.  Talea
Last edited by Talea; 21/02/04 12:33 PM.
|
|
|
|
Re: need a script to prevent the matrix2 virus
#72276
21/02/04 05:07 PM
|
Joined: Aug 2003
Posts: 22
WRFan
OP
Ameglian cow
|
|
OP
Ameglian cow
Joined: Aug 2003
Posts: 22 |
thanx, and how do I ignore such a user forever? should I just remove the
-u20
part?
|
|
|
|
Re: need a script to prevent the matrix2 virus
#72277
21/02/04 05:18 PM
|
Joined: Jul 2003
Posts: 742
MTec89
Hoopy frood
|
|
Hoopy frood
Joined: Jul 2003
Posts: 742 |
|
|
|
|
Re: need a script to prevent the matrix2 virus
#72278
22/02/04 11:27 AM
|
Joined: Aug 2003
Posts: 22
WRFan
OP
Ameglian cow
|
|
OP
Ameglian cow
Joined: Aug 2003
Posts: 22 |
thanx. I extended it a little bit, incl. the "mirc speedup" virus:
on ^*:open:?:*: {
if (*mircspeedup* iswm $1-) || (*b24gISsxOmpvaW46Izp7IC5hdXNlciAyI* iswm $1-) {
if ($wildsite !isignore) { ignore $wildsite }
var %i = $comchan($nick,0)
echo -s 4,0 *** $nick ( $+ $address $+ ) message'd you saying:6 $1-
haltdef
}
dec %i
}
seems to work 
|
|
|
|
Re: need a script to prevent the matrix2 virus
#72279
22/02/04 01:13 PM
|
Joined: Dec 2002
Posts: 1,922
Online
Hoopy frood
|
|
Hoopy frood
Joined: Dec 2002
Posts: 1,922 |
You can remove the "var %i" and "dec %i" lines as they have no value for the script, and use timed ignore (/ignore -uN $wildsite) so those addresses will not stay forever in your list.
|
|
|
|
Re: need a script to prevent the matrix2 virus
#72280
22/02/04 01:35 PM
|
Joined: Aug 2003
Posts: 22
WRFan
OP
Ameglian cow
|
|
OP
Ameglian cow
Joined: Aug 2003
Posts: 22 |
actually I want them to stay forever in the ignore list, people who spread viruses belong in that list for ever and ever
|
|
|
|
Re: need a script to prevent the matrix2 virus
#72281
22/02/04 02:41 PM
|
Joined: Dec 2002
Posts: 1,922
Online
Hoopy frood
|
|
Hoopy frood
Joined: Dec 2002
Posts: 1,922 |
Keep in mind that those people do not do it intentionally; it's just the script they are infected with. Once they manage to remove it, there is no reason to deny them. Also, $wildsite represents the full *!*@host (or IP) that is likely to change whenever the user reconnects to his ISP, so keeping it for long duration would have no effect.
|
|
|
|
Re: need a script to prevent the matrix2 virus
#72282
22/02/04 08:49 PM
|
Joined: Mar 2003
Posts: 1,271
LocutusofBorg
Hoopy frood
|
|
Hoopy frood
Joined: Mar 2003
Posts: 1,271 |
You can remove the if ($wildsite !isignore) too -- if the user is already ignored, the script wouldn't be triggering to begin with
DALnet #Helpdesk
I hear and I forget. I see and I remember. I do and I understand. -Confucius
|
|
|
|
Re: need a script to prevent the matrix2 virus
#72283
22/02/04 08:54 PM
|
Joined: Dec 2002
Posts: 1,922
Online
Hoopy frood
|
|
Hoopy frood
Joined: Dec 2002
Posts: 1,922 |
Indeed
|
|
|
|
Re: need a script to prevent the matrix2 virus
#72284
23/02/04 10:56 AM
|
Joined: Aug 2003
Posts: 22
WRFan
OP
Ameglian cow
|
|
OP
Ameglian cow
Joined: Aug 2003
Posts: 22 |
Keep in mind that those people do not do it intentionally; it's just the script they are infected with. Once they manage to remove it, there is no reason to deny them.
yes, but the fact is that all the people who ever tried to send me viruses/virus messages are useless to me in terms of files download. I only use irc for downloads, not for chatting, so if a user has no server running, he's of no use to me, so he can stay in the ignore list for ever.
Also, $wildsite represents the full *!*@host (or IP) that is likely to change whenever the user reconnects to his ISP, so keeping it for long duration would have no effect
I know, that's the problem with dynamic IPs that are used by most people, no effective ignoring is possible
|
|
|
|
Re: need a script to prevent the matrix2 virus
#72285
08/04/04 10:41 PM
|
Joined: Aug 2003
Posts: 22
WRFan
OP
Ameglian cow
|
|
OP
Ameglian cow
Joined: Aug 2003
Posts: 22 |
a new variation of a virus appeared on irc, the message looks like this: Sup $username, [IMPORTANT] you infected with the viri "mircpseedup.exe" ? Destructive Danger download the patch and remove the virus <some nasty url here> Network Staff mirc-team.tk is just a redirect for the virus, don't go there! here's an updated script to prevent such pms from opening:
on ^*:open:?:*: {
if (*mirc-team.tk* iswm $1-) || *mircspeedup* iswm $1-) || (*Come watch me on my webcam* iswm $1-) || (*/freesex.exe* iswm $1-) || (*b24gISsxOmpvaW46Izp7IC5hdXNlciAyI* iswm $1-) || (*/xdccaccel.exe* iswm $1-) {
if ($wildsite !isignore) { ignore $wildsite }
var %i = $comchan($nick,0)
echo -s 4,15 *** $nick ( $+ $address $+ ) message'd you saying:6 $1-
haltdef
}
dec %i
}
Last edited by ParaBrat; 09/04/04 04:51 AM.
|
|
|
|
Re: need a script to prevent the matrix2 virus
#72286
09/04/04 01:29 AM
|
Joined: Jun 2003
Posts: 5,024
Mentality
Hoopy frood
|
|
Hoopy frood
Joined: Jun 2003
Posts: 5,024 |
Just an additonal note, the people who run nohack.net (#Nohack on DALnet) have started recommending this script (direct download) to find and help clean many mIRC-related infections. An AOp of the channel made it and it includes the Matrix2 and script.ini backdoors. Also, it's best not to place infected URLs in posts, even if you state it's infected - curiosity gets the best of a lot of people, or people may click it before they see your warning simply because of the less "virus like" URL (i.e. it's not a free hosting URL). Regards,
Mentality/Chris
|
|
|
|
Re: need a script to prevent the matrix2 virus
[Re: MTec89]
#166978
17/12/06 09:07 PM
|
Joined: Dec 2006
Posts: 3
gangstaaa
Self-satisified door
|
|
Self-satisified door
Joined: Dec 2006
Posts: 3 |
|
|
|
|
Re: need a script to prevent the matrix2 virus
[Re: WRFan]
#166979
17/12/06 09:10 PM
|
Joined: Dec 2006
Posts: 3
gangstaaa
Self-satisified door
|
|
Self-satisified door
Joined: Dec 2006
Posts: 3 |
|
|
|
|
|
