This is the new home of the egghelp.org community forum.
All data has been migrated (including user logins/passwords) to a new phpBB version.


For more information, see this announcement post. Click the X in the top right-corner of this box to dismiss this message.

trojan scan script

Requests for complete scripts or modifications/fixes for scripts you didn't write. Response not guaranteed, and no thread bumping!
Post Reply
A
AWoL
Voice
Posts: 6
Joined: Mon Aug 14, 2006 9:55 am

trojan scan script

Post by AWoL »

Our room is getting hit by a few turkish spam scripts including kelebek, khlayve, sohbet, and others. I understand that these are infected mirc scripts and replicate with installation. Is anyone else having problems with these bots, and are there any effective scanners or methods to deal with them. My eggies currently run netbots with sentinel, no!spam by ppslim, and clone protection. Any help would be appreciated
User avatar
demond
Revered One
Posts: 3073
Joined: Sat Jun 12, 2004 9:58 am
Location: San Francisco, CA
Contact:

Post by demond »

how do you detect these? if by some signature in their nick/ident/irc name, you can use xchannel; if by ctcp version, you need another script (i plan on adding such check to mine)
connection, sharing, dcc problems? click <here>
before asking for scripting help, read <this>
use

Code: Select all

 tag when posting logs, code
A
AWoL
Voice
Posts: 6
Joined: Mon Aug 14, 2006 9:55 am

Turkish Spam bots

Post by AWoL »

Well, other than hoping our 'spy' eggie (the main tcl from no!spam) detects the spam messages on join, I have so far noticed 5 seperate idents, so I have loaded a tcl i found on egghelp called 'badident' and added the following idents to scan for ...
*TurkMirc*"
"*Kacak*"
"*Yuzuk*"
"*TurkChat*"
"*KELEBEK*"

So far this is working pretty well, but I was hoping there was a more efficient method of scanning for these damn things, possibly a version reply
User avatar
caesar
Mint Rubber
Posts: 3778
Joined: Sun Oct 14, 2001 8:00 pm
Location: Mint Factory

Post by caesar »

demond wrote:[...] (i plan on adding such check to mine) [...]
Just wait for him to finish. :) Anyway, back to topic. This kind of stuff have been discussed before and some solutions/answers/etc. where given. You should try a search and see what others have debated on this and decide your next move.
Once the game is over, the king and the pawn go back in the same box.
C
Callisto
Halfop
Posts: 86
Joined: Sun Mar 13, 2005 11:04 am

Post by Callisto »

Until Demond does his script I wonder if this will help? It is a version checker, pretty simple but it does work ok.
http://longshanks.dyndns.org/eggdrop/vhunter.tcl

Regards callisto
User avatar
Alchera
Revered One
Posts: 3344
Joined: Mon Aug 11, 2003 12:42 pm
Location: Ballarat Victoria, Australia
Contact:

Re: Turkish Spam bots

Post by Alchera »

AWoL wrote:So far this is working pretty well, but I was hoping there was a more efficient method of scanning for these damn things, possibly a version reply
I doubt a version reply would help actually; they use mIRC and unless there is something "quirky" in their real name field you're better sticking to what is actually working for you right now. :)
Add [SOLVED] to the thread title if your issue has been.
Search | FAQ | RTM
V
VanDaMe
Voice
Posts: 8
Joined: Thu Nov 02, 2006 1:07 am

Post by VanDaMe »

can someone modify it please so if user doesn't giving a reply within x mins, the bot will ban him. Thank you
Post Reply