Forums Bug Reports Backdoor bug? Imposters able to post text as you.

Recently when I connected to irc.usachat.net with the new mIRC 6.03 and joined the #Lobby, my msg blocker blocked multiple messages from 3 users, but somehow they were able to make my mIRC client post and spam a kuwait website in the channel as if I said it. How in the hell is that possible? Due to this situation, I have stopped using mIRC until I hear about a fix for this. FYI - I run no scripts other than the standard script that comes with mIRC and a msg blocker that I coded myself. It's pretty much a raw mIRC 6.03.

Anyone else heard of this?

Its possible that something you downloaded/opened put a backdoor or trojan that is causing you to spam. First thing i would do is run a couple good virus scans, including one of the good free online ones that tend to be better at catching IRC related trojans, like housecall at www.trendmicro.com

I'd also double check your remotes to see if anything has been altered. You said it looked like you posted it, can you recall exactly what it looked like? (keep in mind its likely some trojan caused it)

there is also a mode +n/-n(external messages) if mode -n is on thn sum1 can clone your nicknam and send messages through it, the only solution is turning +n back on if thats what was causing it

They can't clone your nickname. IRC only allows one user to use a particular nickname at a given time. All -n does is allow people who are not in the channel to send messages to the channel, it has nothing to do with impersonation.

it will say, nicknameyoutriedtoclonehere nickname in use.
thats when you can send a message....

What are you talking about? Give me an example, because I'm 100% sure you're wrong.

BleachX, if you want to get rid of this, then I recommend joining channel #dmsetup and/or #mircfix on EFNet.

This sounds like a classic worm, possibly installed when you visited a website that was spammed to you, the same way you're spamming it to others now.

- Raccoon

say if your in a channel called %#example, and theres someone called blah, you type /clone blah, it should say nickname in use, then you type /msg %chan yourtexthere and it mode -n is on it sends the message through their nickname.

alias clone {
.set %chan $chan
/part %chan
/nick $1-
/join %chan
}

Uhh... no it doesn't.

uhhhhh it does on some servers

You should notify the server admins of a serious bug then, because that would never work in a million years on any decent server.

its not a serious bug......
mode n(external messages)

Any bug which allows someone to imitate someone else, even when it requires a commonly used mode to be unset, is still a serious bug.

for the servers that do allow that then, it is simple to write a script to tell which one is the clone, coz when this event does occur you get 2 addresses, then u can simply perform a who on both to see which is the clone.

I think you haven't a clue what you're talking about. Any server that does that is first off the worlds dumbest and lamest server around, and furthermore I doubt it even exists on any servers. So what server does it work on? Or are you going to do like in the other post when I asked for the server name you give me the server, but then when I try to connect you inform me that it is currently down...

it works on msn. it works on my m8s server,(the one u cudnt connect to) it works on irc.redfuse.org to name a few.

MSN is NOT IRC. And isn't it an odd coincidence? irc.redfuse.org doesn't work either!
[13:33] * Connecting to irc.redfuse.org (6667)
[13:33] * Unable to resolve server
[13:34] * Looking up irc.redfuse.org
[13:34] * Unable to resolve irc.redfuse.org

So lets see, you named one server thats not even an IRC server (it's IRCX) and 2 servers that just happen to either be down, or not even exist. Or when you said irc.redfuse.org did you really mean irc.digitalfuse.org (which is what www.redfuse.org says the IRC server is)? And well guess what? That server runs Unreal3.1.5.1-Valek which I happen to be the author of; and I know for a fact that it does NOT do what you described.

~ tidy trax ~ says:
whats the name of the server chris goes on again?
Admin_Appothis - [BA] says:
dunno
Admin_Appothis - [BA] says:

~ tidy trax ~ says:
;\
Admin_Appothis - [BA] says:
they closed down
Admin_Appothis - [BA] says:
lol
~ tidy trax ~ says:
;\

So basically it's exactly what I said, you can provide no proof of your claims at all.

ok.... well sorry for trying to help then;\ when this event has happened to me many times, i will still suggest it even if i am unsure of how many servers this is ok on;\