Another virus affecting my network this morning

U · Eleet Joined: 18 Jun 2003 Posts: 521 Location: IRC

Random bots with random nicks sending stuff similar to:

<heunubtpu> "Miss Cleo knows all, she is readin yer thoughts right now, she is putting you into mindjail http://80.11.4.129:3030/mindjail.zip"

I have been akilling them as spammers-if you don't they seem to loop and come back every 30 mins. They take a /list and join every channel with 10+ users, message everyone, and depart.

If you have +R for channels, seems to be the best way to avoid them.

I don't recall the name but there was a virus reported yesterday on yahoo news, probably related to it.

If only people wouldn't download files from people they don't know Smile

Jason · Posted: Jun 27, 2003 2:14pm Post subject:

bah. I hate these stupid things.

They play a big part in why it's getting difficult to run even a simple /list anymore.

Orare · none Joined: 12 May 2003 Posts: 17

We're seeing them also... have a log file that goes on for hours of them logging on. Only consistancy we see so far is they are all 9 letter random alpha nicks.

U · Eleet Joined: 18 Jun 2003 Posts: 521 Location: IRC

They stopped about an hour ago on my network, course we've been akilling them all morning-maybe we got them all, who knows.

Either that or people actually run anti-virus on occasion.

U · Eleet Joined: 18 Jun 2003 Posts: 521 Location: IRC

Jason: I can see what you mean. Alot of my channels went +s this morning.

Till they realised they could go +R, block non registered nicks, and not be out of the /list Smile

They liked that option alot better, course now alot more people are registering-which is probably a good thing for everyone involved.

Orare · none Joined: 12 May 2003 Posts: 17

They stopped here at the same time. Probably the script kiddies bedtime.

Michael · none Joined: 18 May 2003 Posts: 48

Got those this morning at DilexNET, however, they only came on once, said their bit and left.

It's kinda like a talking and not as big fizzer attack.

U · Eleet Joined: 18 Jun 2003 Posts: 521 Location: IRC

Well considering anti-virus places jumped on it quick, its likely that the spread was stopped fast. It was a .zip file and alot of corporate environments block email attachments of zips by default.

I don't think it ever even had a chance-I haven't seen any in 24 hours, but we akilled the ones we saw-so they probably are still out there, just not able to connect.

Jason · Posted: Jun 28, 2003 11:27am Post subject:

It's been such a long time since I ran my Undernet server, I can't recall, but it seems to me ircu had a target change too fast error when a user tried to join many channels in N amount of minutes.

Even if I'm mistaken, that anti mass /msg code that throttles users could easily be adapted to throttle for /joins. It might not stop this type of activity, but it sure could make it slow as hell to accomplish :)

U · Eleet Joined: 18 Jun 2003 Posts: 521 Location: IRC

Yeah I don't think this one was planned too well-it already appears to have disseapeared off the radar screen after 2 days of it causing an issue-and the issues it caused were very minor.

Orare · none Joined: 12 May 2003 Posts: 17

We have these guys back this morning.. anyone else seeing them?

U · Eleet Joined: 18 Jun 2003 Posts: 521 Location: IRC

Was just going to post.

They appear to be back with different ads, maybe someone released a modified version?

Going back to akilling on sight for a while.

Jason · Posted: Jul 01, 2003 12:22pm Post subject:

rofl. At least they are changing ads. Nothing worse than staring at the same spam ads repeatedly.

They likely want to test to see if the new ads get a better click-through-rate than the previous.

Orare · none Joined: 12 May 2003 Posts: 17

lol.. its keeping one of our ircOPs busy as all get out.. but we see absolutely no pattern, and they arent repeating the ip numbers.. so imho akills just satisfy the inner urge to DO SOMETHING!!!!

Using it now as training for some of the newer ircops.

Orare · none Joined: 12 May 2003 Posts: 17

Have you noticed that they ping out if not killed?