W32.HLLW.Fizzer@mm

Horizon · Posted: May 13, 2003 10:03am Post subject: W32.HLLW.Fizzer@mm

I'm not sure how many networks out there are being effected by this virus. But by reading around it seems quite a number of networks are being overloaded with these trojan clients.
Our network as started automatically glining these clients on entry to currently about 30 - 40 different channels ( and were still adding more ) . At the moment our /stats k is sitting somewhere are about 6 thousand network bans. So far there have been no problems with the opperation of our network.
I'm more annoyed with the services notices then anything else at the moment but are there many other people out there whome admin networks that are experiencing the same thing?

Jason · Posted: May 13, 2003 12:09pm Post subject:

I can verify for a fact that several IRC networks are being hit by it. All so far that I've seen are relatively small networks (puzzling why the virus author selected small networks, since they would be the ones fastest to spot a problem -- whereas a network with 100,000 users isn't likely to notice a few thousand extra users).

Anyway, to make a long story short, the reason I know that several networks have a problem with Fizzler, is because the SearchIRC index robot has been glined on approx 10 networks. The reason for this ranges from the operator setting glines is blocking whole class A's (216.*), or because the index robot signed onto the network around the same time as fizzler robots and got caught in the cross fire.

Most networks contacted have removed the gline immediately (Thanks!), however others have been slow to respond. The only negative side effect of this (for SearchIRC) is that some networks may have slightly outdated channel results.

Horizon · Posted: May 13, 2003 3:51pm Post subject: AccessIRC Current NetInfo

It does seem somewhat strange this virus would collect for use on smaller networks like you said.. Whats even stranger in every channel they join the bots create a different channel key in every instance. Seems like somone spent some time on this one.

http://www.regina.sask.cc/glines.jpg

Guest · Posted: May 14, 2003 2:38pm Post subject:

From the reports coming in, it's not just smaller networks. It's just that the smaller networks are noticing the 1000 or so extra clients far more than the bigger ones.

This is certianly creating a stir in the community, so much so that there's a collaboration between networks going on to fight it off. Who would've thought THAT would ever happen..?

fadeaway · none Joined: 14 May 2003 Posts: 2

Over 70 (?!) networks are involved with the collaboration now! A great day for the IRC community indeed.. only good can come from the networks collaborating regarding security issues! Very Happy

http://www.debugoutput.com/fizzer.php

Horizon · Posted: May 14, 2003 3:30pm Post subject:

Guest · Posted: May 14, 2003 10:53pm Post subject:

You might want to read the article on www.IRC-Junkie.org ...

There is a organisation fighting abuse spreading over multiple networks for a long time already, CERT-IRC

Seems to me IRCNews isnt well informed here (as often seems to be the case)

fadeaway · none Joined: 14 May 2003 Posts: 2

Thanks for the trolling! And anonymous at that! What a champion! Very Happy

Guest · Posted: May 21, 2003 4:19pm Post subject:

I'm a troll and I resemble that remark

Jedi · none Joined: 07 Jul 2003 Posts: 26

Our network has not had a problem with the fizzer virus at all.
The network is in my signature
Very Happy

U · Eleet Joined: 18 Jun 2003 Posts: 521 Location: IRC

We had issues with fizzers the first go-round, but since then haven't been seeing any.

Maybe whoever released the new version didn't include my network, if so, THANK YOU. They are a bitch.