mIRC Home    About    Download    Register    News    Help

Print Thread
Joined: Nov 2003
Posts: 84
S
Static Offline OP
Babel fish
OP Offline
Babel fish
S
Joined: Nov 2003
Posts: 84
Hello there Im an ircop and we are being plagued by a worm, well theres a trick the seem to join a room part change nicks and then pm ppl with a link thatll infect them. The message is always the same but the link always is that person host. They change to fast to whois so Id like to filter out the addy from the message:
<{|{]`vZ}> Come watch me on my webcam and chat /w me :-) http://This.is.where.the.addy.goes:PortNumber/file.ext
Any help would be greatly apprecited


chat.irchat.tv
#Help #Trivia #Scripts
Co-Admin @ IRChat.tv
Joined: Dec 2002
Posts: 1,922
O
Hoopy frood
Offline
Hoopy frood
O
Joined: Dec 2002
Posts: 1,922
  • On ^*:open:?:Come watch me on my webcam and chat *:{
    echo 4 -ta $nick is infected with a worm. Host: $gettok($mid($12,8),1,58)
    }


$12 is the 12th word of the sentence, (http://[/b]host:port/file.ext)
$mid(...,8) returns the word starting from the 8th letter (host:port/file.ext)
$gettok(...,1,58) splits the partial word and returns the host only (host).

You may add the command /haltdef to this event to prevent the query window from opening at all.

Also note that the server command /whowas <nick> is available for you, so you can still find the host of someone who just quitted or changed nick.

Joined: Nov 2003
Posts: 84
S
Static Offline OP
Babel fish
OP Offline
Babel fish
S
Joined: Nov 2003
Posts: 84
Thank you Ill try this out and convert to my needs. Whowas isnt always available, You have to be on the same server as that nick was.


chat.irchat.tv
#Help #Trivia #Scripts
Co-Admin @ IRChat.tv
Joined: Dec 2002
Posts: 1,922
O
Hoopy frood
Offline
Hoopy frood
O
Joined: Dec 2002
Posts: 1,922
Are you sure about that? I tested on DALnet, EFNet and Undernet, and /whowas seems to work regardless of whether you and the user were on the same server.

Joined: Dec 2002
Posts: 417
O
Fjord artisan
Offline
Fjord artisan
O
Joined: Dec 2002
Posts: 417
I seen something simular on Dalnet a few years ago. I was able to detect the Bots by doing a version on the Nick when they came in. I found the version reply was %email or %temp. Its just a suggestion but it may be a place to start




Intelligence: It's better to ask a stupid question, then to prove it by not asking....
Joined: Nov 2003
Posts: 84
S
Static Offline OP
Babel fish
OP Offline
Babel fish
S
Joined: Nov 2003
Posts: 84
Yea they didnt respond to a version at first but now they do. And in responce to the guy up above othello I cant do whowas if they person was on another server just the way it works. Also if you know of anyone infected with this we have made a fix to see it goto http://www.irchat.tv Its on the main page.


chat.irchat.tv
#Help #Trivia #Scripts
Co-Admin @ IRChat.tv

Link Copied to Clipboard