I have recently been having problems with DCC download bots (Bottler, IRC-Ork, etc). I am trying to get rid of them. I am writing an Eggdrop script for on-join auto-detection of such users and I need a little information for one of the features I am adding.

Obviously, mIRC is the most popular IRC client. Most of these unwanted bot users will falsify a CTCP VERSION replies with something that resembles mIRC. However, many do it incorrectly. They respond with obvious bogus information like simply "mIRC 6.12". I have even seen people so lazy as to put just "mirc".

What I am doing is coding a malformed mIRC CTCP VERSION reply check. Users who reply with "mIRC" but do not fit the correct format will be considered a fake.

I was wondering if anyone had a list of all of the different LEGITIMATE mIRC CTCP VERSION replies. I want to be sure that visitors using older clients are not auto-banned on accident.

Here are a few VERSION replies that I have compiled (not all are confirmed):
mIRC32 v2.1a K.Mardam-Bey
mIRC32 v2.3a K.Mardam-Bey
mIRC 6.01 Khaled Mardam-Bay
mIRC32 v6.1b K.Mardam-Bey (private beta)
mIRC64 v7.0b K.Mardam-Bey (private beta)
mIRC69 v6.9b K.Mardam-Bey (private beta)
mIRC v6.12 Khaled Mardam-Bey

Please correct any information I have wrong. Also when was the change made to the mIRC code to force the version reply? Thanks.

One thing you can do is, do two versions on them
spaced a few seconds apart, mIRC will only reply
to one version in 10 seconds, so if they reply to a
second version a few seconds later, it's not mIRC.

To answer your question:

All VERSION Replies from v4.7 to v5.91 looked like this:
[*]mIRC16 v4.7 K.Mardam-Bey
[*]mIRC32 v5.91 K.Mardam-Bey

And Replies from v6.0 and up look like this:
[*]mIRC v6.12 Khaled Mardam-Bey

There have been no versions released that state "mIRC64" or "(private beta)" in the reply.
Versions before 4.7 had somewhat inconsistant version replies, but should be banned anyway because they're rittled with bugs.

To put this into a faithful regular expression:
[*]/mIRC(?:16|32)? v\d\.\d+ K(?:\.|haled\s)Mardam-Bey/
or more critically
[*]/mIRC(?:16|32) v5\.\d+ K\.Mardam-Bey|mIRC v6\.\d+ Khaled Mardam-Bey/

Also, what EVH suggested is a keen idea.

- Raccoon

Since you can't tell about future versions, I'd really go with what EVH has suggested first.