Undernet User Script
Commands List
Spambot Killer
This script currently works on two
types of spambots/drones.
Type One :
These bots spam web links
leading to Trojan viruses, or attempt to DCC send
The virus directly to users on join, or on part.
Their nicks use regular alphabet letters (n0
l33tn3ss) and read a random nickname from a file upon connect.
They use the same nickname until disconnected.
They ignore ctcp version
requests.
The first letter
of the name is always Capitalized. At the end of the name,
There will be a
random number between 10 and 40.
This script
detects that pattern on join. I have a
pre-set list of known nicknames
That these bots
use. If the “name” portion matches that
list, and the nickname
Ends in numbers
10-40, you will kickban it immediately on join.
If the “name” is
NOT in that known bad nick list, you will :
1) Whois the user
2) Look for a channel other
than your own
a.
If found, join one of the bots other channels
i.
Part the channel in 3 seconds
b. If not found, part/rejoin
your own channel
3) Wait 45 seconds for the
nickname to spam you
a.
If spam received, kickban user
Type Two
These are smarter bots. And they suck, a lot. The virus powering these bots causes them to
connect to IRC 3 times. One bot sits back and does nothing but spam users with the
virus link/files… while the other 2 go hopping around channels looking for
victims. Those 2 spybots
send the nicknames to the 1 spambot to be spammed.
These bots are first identifiable again by the
nickname. It is always female(ish), and often contains l33t l3tt3rs like 3 for an “e”, 4
for an “a”, 1 for an “I”, and 0 for an “o”.
Like type one bots, they have the number on the end
of their nickname. They also, more often
than not, have some sort of character between the “name” and the
“number”. A character is anything other
than a number or letter that’s allowed in nicknames… such as
:| ^ - _.
When
the nickname pattern is detected on join, you will :
1) /ctcp
nickname version
2) Unlike a regular
client/user, who will reply to a /ctcp with a /ctcpreply and their version, these bots use NOTICE to send
their version reply. They’re running
TELNET 0.2a
3) When that notice is received
in response to the version request, you will kickban
the user.
Sample Spambot Reply : -Heidi|20-
VERSION Telnet 0.2a
If
you type /who *IP.or.host.here* and check status
window for one of these bots :
*
N1na-23 H ~N1na-23@dialin-212-144-133-039.pools.arcor-ip.net
:3 sEWuxavl ----- SPAMBOT
#Rapidenet
D0lly^18 H+ ~Tanya_20@dialin-212-144-133-039.pools.arcor-ip.net
:3 iYmhGwmbd ----- SPYBOT
#orhei
Melania^18 H ~Kathia^18@dialin-212-144-133-039.pools.arcor-ip.net
:3 OwW -----
SPYBOT
dialin-212-144-133-039.pools.arcor-ip.net End of /WHO list.
To enable, right click in
channel and choose “General Channel Settings”
Or type /chansettings
Any questions/suggestions? Feel free to visit me in #UndernetUserScript.
Connect
This provides several functions upon
connection to Undernet
X Login and Auto-Join
1)
If
desired, automatic login to X and +X Settings
2)
Joins
channels set in auto-join list after either :
a.
10
seconds
b.
Successful
Login to X
3)
After
joining all channels
a.
Runs ‘loginscripts’ signal for anything you need to add
b.
Performs
/who on all channels to update IAL
Channel Ownership
1)
After
joining a channel, if you are the first (only) person to enter it, you will
automatically set mode +tnl on channel
2)
If you
are on an opless channel, and everyone leaves
(channel is empty) you will automatically cycle the channel to regain ops.
@X Window
All of X’s replies to you (notices) will be put in this window… the
regular notice from X (displayed in status/active window) will be halted
(stopped).
Kicks & Bans are also put in this window, but are also displayed in
channel.
@Spy Window
This window logs any channel message or action that contains your
nickname in it (for when afk – return to computer and
check @spy window). I will be adding
settings later to let you specify your own *matchtext*.
Channel Floodpro
This script has settings under the
Channel Popup Menu --> General Channel Settings.
Setting is either ON or OFF - due to the fact that it masskickbans I do not feel safe allowing the other settings
to be easily changed... if you're a scripter, you'll find the code easily changable to your likings.
This Script Protects Channels against the following types of bot flood :
1) Message Repeat Flood
2) Notice Repeat Flood
3) Part Message Repeat Flood
4) CTCP Flood
5) Revolving Door Flood (join/part)
6) Randomized Nickname Flood
#'s 1 thru 4 and #6 will activate +ml-vvvv on the 6th
repeat/join,
and on the 7th and after repeat/join, it will mass kickban
(+bbbbbb)
The +m lasts for 2 minutes, and is reset to its previous state.
#5 will trigger and massban after the 10th join/part
** Ops are excluded from floodpro checking
** Users with custom level "exempt" are excluded from floodpro checking
i.e. /auser exempt *!*@your.ip.or.host
This is one of my favorite scripts, and as of now, only
works for one channel.
What it does is combine a userlist, floatlimit, and delayed voice into one mode
When a user joins :
Level 5 : AutoOp : User is voiced, opped, and limit is floated in one mode +lov
Level 2 : AutoVoice : User is voiced and limit is floated in one mode +lv
Level 1 : Default : User is voiced on a delayed timer and limit is floated on a delayed timer… both are flood sensitive to prevent attacks
** Use of channel management removes the need for a regular auto-op or auto-voice list **
To enable channel management for ONE channel : type : /manage #channel
Use the Channel Management option on the Nicklist popup menu to add level 5 or 2 to user(s).
These options are turned on by right clicking in channel and selecting
“General Channel Settings”. Both are flood-sensitive and are designed
to slow down botnet attacks. The default # to float by is 3.
These provide the graphical interface with checkboxes and settings for :
General Channel Settings, Multi-Nickname Settings, & X Settings
If you’ve been on IRC a while, you’ll remember the DCC
exploit that affected
MIRC versions 6.01 to 6.11. If some lamer still tries to use that one on you or
A channel you’re on, you’ll global kickban him on all channels.
This code is used to record the nicknames of the last
person to join or speak on
A channel, as well as last person to notify you. These are used in the F9, F11, and F12
Function key shortcuts (devoice last spoke, kick last spoke, kickban last join).
This is a 20 nickname jupebot. It allows you to set up to 20 nicknames that you like,
Numbered 1-20. Nickname #1 is highest priority, #20 is lowest. You check for these
Nicknames to be free and change nicknames only when a nickname of higher priority
Than your current nick becomes available.
This script is designed to protect
you from Botnet Floods.
It is enabled all the time and no settings are required.
It works for CTCP, query, notice, and invite floods.
Triggers after 3 ctcps/queries/notices/invites are
received within 3 seconds from 3 different users.
Once triggered, activates server SILENCE +* command for 2 minutes, then UNSILENCE's
Silence is a server-side ignore, blocking any private floods from ever reaching your computer… Regular mIRC /ignore only blocks the flood from being displayed once received from the server, but still receives it (which is what knocks you offline in large floods – too much data from too many users in too little time)
Will this protect you every time?
NO! There's about a 50% chance that a VERY LARGE botnet
will manage to send you enough data to flood you off before your /silence
command has time to reach the server. If that is the case, there is
absolutely nothing you can do to prevent being flooded off *unless* you already
had /silence issued BEFORE the attack began.
This was tested using over 2000+ drones (not mine!) on Undernet
servers. If you have been attacked
recently, or are attacked often, issue /silence +* immediately upon server
connection (add to remote_connect.ini under loginscripts
signal) or PERFORM options.
This code acts as a quotes bot for all your channels.
Quotes for each channel are
Stored separately, and are numbered on a global system to reflect total number of
Quotes. Commands for it are as follows :
Everyone :
.q - returns random quote
.q searchtext - searches quotes for searchtext
Voice & Ops :
.aq quote here - adds quote to database
Ops Only :
.rq number - removes quote #number
** You can type /quotes in channel to say instructions on how to use the Quotes. **
** CAUTION ** THIS
SCRIPT GIVES FULL REMOTE CONTROL OF YOUR
COMPUTER TO THE MASK YOU GIVE IT. ONLY USE THIS
IF YOU KNOW WHAT YOU’RE DOING!
Users with level GOD are able to use the remote control commands
/auser GOD nick!ident@SECUREhostmask
Remote Control Commands :
.rc <commands> : performs <commands>
example : .rc op #somechannel somenick
..<commands> : performs <commands> with text replacement
lj = last join
ls = last spoke
ljip = last join’s ip *!*@host
lsip last spoke’s ip *!*@host
# = current channel
me = nick typing trigger
you = client running this script
examples :
..o me
..kb lj Get the hell out, Lamer
..u ljip
..mode # +I
..mode # +o-o me you
You can protect/exempt users by using the Channel Management Nicklist Popup menu
Protect = Revenge against users who kick or ban you or your protected friends.
Kick revenge = Kick user
Ban revenge = Ban user
Exempt = these users are allowed to kick or deop protected users WITHOUT revenge from
You – you’ll do nothing.
Channel Managers/Owners should of course, then, have both protect & exempt set for them
This script is for the automatic decoding of the
backwards and simplecoded text.
Who/Whois
Scanner
This is an
on-join and who/whois scanner that shitlists anything matching *matchtext*
Example matchtext phrases : “owned by” –
“somehackername” – etc.
This is NOT enabled yet as of this version… I haven’t
created the settings yet.
X-Mail
This script
turns your mIRC client into a mail server for +x
users. I limited use to +x
Users only to prevent abuse and for
ease of use and coding.
Triggers :
.xm w
<username> <your text here> - writes xmail to username
.xm r - reads your xmail
.xm h - displays x-mail
help
**
Note : All of the triggers work via channel, query,
and notice **
**
Note : It will reply to the user in the same way it
was received **
**
i.e. if they /notice yournick
.xm r - you’ll send them their messages via notice **