# Drone detector v2.0 # (c) 2005, Bas 'soczol' Verhoeven package require http set drone_chans {"#chan1" "#chan2" "#chan3"} set drone_kick "%virus% drone detected (ID: %id%)" set drone_kick_blacklist "Blacklisted host because of a %virus% drone (ID: %id%)" set drone_exempt_flags "Fn" set drone_user "DroneDB" set drone_debug 1 # Remove this line when done configuring ;) die "You have not configured drone.tcl yet.." # Don't touch from here... if {![validuser $drone_user]} { adduser $drone_user "-drone!*@*" setuser $drone_user comment "Drone Info User -- Do not delete" setuser $drone_user xtra count 0 } bind join -|- * drone_join bind raw -|- 311 drone_raw_whois bind raw -|- 319 drone_raw_whois bind raw -|- 318 drone_raw_whois bind msg -|- "removeme" drone_removeme proc putdebug {txt} { if {$::drone_debug == 1} { putlog "(drone-debug) $txt"; } } proc drone_join {n u h c} { set ::needwhois 0 putdebug "Got join for $n($u) $h in $c" # Determine if we need to check for drones in this channel foreach chan $::drone_chans { if {![string compare -nocase $chan $c]} { set drone_chan $chan; break; } } if {![info exists drone_chan]} { return; } # Authed (+x) users and quakenet staff are allowed to join without getting kicked. if {[string match "*.quakenet.org" $u]} { return; } # Users that are known by the bot, or that are exempt from drone checks # are allowed to pass without getting kicked. if {[matchattr $h $::drone_exempt_flags]} { return; } # Users that are whitelisted (by adding their hostmask to the drone-db user) # are allowed to pass without getting kicked. if {$h == $::drone_user} { putdebug "Whitelisted join: $n" return; } # Users that are blacklisted will be kicked immediately set hostname [lindex [split $u "@"] 1] if {[getuser $::drone_user xtra "$hostname_id"] != ""} { putdebug "Blacklisted join: $n" kill_drone $n $u $c [getuser $::drone_user xtra "$hostname_virus"] 1 return; } # Execute dronechecks that don't need extra info (like channels) if {[drone_check_drefir_e $n $u $c] == "drone"} { kill_drone $n $u $c "Win32/Drefir.E"; return } if {[drone_check_flood_i $n $u $c] == "drone"} { kill_drone $n $u $c "Win32/Flood.I"; return } # Execute pre-checks for dronechecks that need extra info drone_check_flood_i_var_prepare $n $u $c] if {$::needwhois == 1} { putdebug "Atleast 1 check found user suspicious, doing full WHOIS.." set ::drone_channel($n) $c set ::drone_username($n) $u putserv "WHOIS $n" } } proc drone_raw_whois {from key data} { set drone_target [lindex $data 1] if {$key == "311"} { set drone_realname [string range [lindex $data 5] 1 end] set ::drone_realnames($drone_target) $drone_realname putdebug "Got realname for user $drone_target: $drone_realname" } elseif {$key == "319"} { set drone_channels [string range [lrange $data 2 end] 1 end] set ::drone_chanlist($drone_target) $drone_channels putdebug "Got chanlist for user $drone_target: $drone_channels" } elseif {$key == "318"} { putdebug "End of whois for user $drone_target." # End of whois -- Execute dronechecks that do need extra info if {![info exists "::drone_channel($drone_target)"]} { putdebug "No channel available for drone, some other script called whois?"; return; } if {![info exists "::drone_username($drone_target)"]} { putdebug "No username available for drone, some other script called whois?"; return; } set c $::drone_channel($drone_target) set u $::drone_username($drone_target) if {[drone_check_flood_i_var $drone_target $u $c] == "drone"} { kill_drone $drone_target $u $c "Win32/Flood.Z"; return } } } proc drone_removeme {n u h a} { set hostname [lindex [split $u "@"] 1] if {[getuser $::drone_user xtra "$hostname_id"] == ""} { putserv "PRIVMSG $n :Your host ($hostname) isn't blacklisted for having drones." return; } if {[getuser $::drone_user xtra "$hostname_removed_on"] != ""} { set remon [strftime "%F %T %Z" [getuser $::drone_user xtra "$hostname_removed_on"]] set remby [getuser $::drone_user xtra "$hostname_removed_by"] putserv "PRIVMSG $n :Your host ($hostname) was already removed from the blacklist on $remon by $remby." return; } set virus [getuser $::drone_user xtra "$hostname_virus"] putserv "PRIVMSG $n :Your host ($hostname) was blacklisted because (what seemed to be) a" putserv "PRIVMSG $n :$virus drone with your host joined one of my channels." putserv "PRIVMSG $n :The blacklist entry has been removed and you will no longer be kicked," putserv "PRIVMSG $n :but for your own safety please check your PC with a (free) antivirus" putserv "PRIVMSG $n :solution like http://housecall.trendmicro.com/housecall/." setuser $::drone_user hosts "*!*@$hostname" setuser $::drone_user xtra "$hostname_removed_by" "$n!$u" setuser $::drone_user xtra "$hostname_removed_on" [unixtime] foreach chan $::drone_chans { resetbans $chan } putserv "PRIVMSG $n :You should have been unbanned from all channels. Thanks for your cooperation." } proc drone_check_flood_i_var_prepare {n u c} { set u [lindex [split $u "@"] 0] if {[string index $u 0] == "~"} { set u [string range $u 1 end] } if {[string tolower $n] == $n && [isalpha $n] == 1 && [string length $n] > 2} { if {[string tolower $u] == $u && [isalpha $u] == 1 && [string compare -nocase $n $u] != 0} { set ::needwhois 1 return "needwhois" } } } proc drone_check_flood_i_var {n u c} { if {![info exists "::drone_chanlist($n)"]} { return } if {![info exists "::drone_realnames($n)"]} { return } set u [lindex [split $u "@"] 0] set r $::drone_realnames($n) if {[string tolower $r] == $r && [isalpha $r] == 1 && [string length $r] > 2 && [string length $r] < 11 && [string compare -nocase $n $r] != 0 && [string compare -nocase $u $r] != 0} { set local_chanlist [split $::drone_chanlist($n) " "] set chtotal 0 set cltotal 0 set chnormal "" set chclone "" foreach chan $local_chanlist { if {[string match "*[string index $chan 0]*" "@+<"]} { set chan [string range $chan 1 end] } if {[string trim $chan] != ""} { incr chtotal } if {[isZivCloneChan $chan] == 1} { lappend chclone $chan; incr cltotal } else { lappend chnormal $chan; } } if {$chtotal == 1} { return "drone" } elseif {$chtotal == 0} { putdebug "User is on 0 channels, eh?" } elseif {$chtotal > 0} { if {$chtotal != $cltotal} { putdebug "User is on normal channel(s): [join $chnormal]" } else { return "drone" } } } } proc drone_check_flood_i {n u c} { # AntiVir: Found BDS/Flood.IRC.2 # Avast: Found Win32:Trojan-gen. {Other} # BitDefender: Found Trojan.Flooder.I # ClamAV: Found Trojan.Flood.I # Dr.Web: Found IRC.Flood # F-Prot Antivirus: Found security risk or a "backdoor" program # Fortinet: Found W32/Flood.I-tr # NOD32: Found IRC/Flood application # VBA32: Found IRC.Flood set pointer [http::geturl "http://dev.bserved.nl/zirvede.php?nick=$n&chan=[string range $c 1 end]" -timeout 2000] set lookup [split [::http::data $pointer] " "] ::http::cleanup $pointer set result [lindex $lookup 0] if {$result == "CLONE"} { return "drone"; } } proc drone_check_drefir_e {n u c} { # AntiVir: Found Worm/Drefir.E # ArcaVir: Found Worm.Drefir.E # Avast: Found Win32:Drefir-F # AVG Antivirus: Found I-Worm/Drefir.F # BitDefender: Found Win32.Worm.Drefir.E # Dr.Web: Found Win32.HLLM.Dref # Kaspersky Anti-Virus: Found Email-Worm.Win32.Drefir.e # NOD32: Found Win32/Drefir.E # Norman Virus Control: Found Sandbox: W32/Backdoor: # # [ General information ] # # * File length: 126412 bytes. # # [ Changes to filesystem ] # * Creates file C:WINDOWSSYSTEMSysDrefIWv2.exe. # # [ Changes to registry ] # * Creates value "DrefIW"="C:WINDOWSSYSTEMSysDrefIWv2.exe" in key "HKLMSoftwareMicrosoftWindowsCurrentVersionRun". # * Creates value "DrefIW"="C:WINDOWSSYSTEMSysDrefIWv2.exe" in key "HKCUSoftwareMicrosoftWindowsCurrentVersionRun". # * Sets value "Start"="" in key "HKLMSystemCurrentControlSetServicesSharedAccess". # # [ Network services ] # * Looks for an Internet connection. # * Connects to "irc.efnet.net" on port 6667 (TCP). # * Connects to "irc.quakenet.org" on port 6667 (TCP). # * Connects to IRC server. # * Connects to "us.undernet.org" on port 6667 (TCP). # # [ Process/window information ] # * Will automatically restart after boot (I'll be back...). # * Creates a mutex [IrcWorm] v1.3 (c) 2005 written by DR-EF. # # UNA: Found I-Worm.Drefir.e # VBA32: Found Email-Worm.Win32.Drefir.e set badnickbase { "Zenia" "Zoe" "Zilya" "Xenia" "Xylia" "Xandra" "Willa" "Wendy" "Vicky" "Vivian" "Violet" "Valora" "Vanessa" "Valda" "Ula" "Uma" "Sharon" "Silver" "Rosa" "Ruby" "Rita" "Rae" "Rachel" "Queen" "Peggy" "Pamela" "Olivia" "Olga" "Nicole" "Naomi" "Natalie" "Nora" "Nina" "Nova" "Nadia" "Maia" "Mary" "Melody" "Mimi" "Myra" "Linda" "Lisa" "Lolita" "Lynn" "Laura" "Lara" "Kara" "Kassia" "Kyle" "Kali" "Kacey" "Katrina" "Janet" "Jewel" "Joanna" "Juliet" "Julie" "Ida" "Idona" "Isabel" "Iris" "Ivana" "Ivory" "Helga" "Holly" "Haley" "Gloria" "Gilda" "Gale" "Faith" "Emily" "Evelyn" "Eve" "Erika" "Eliza" "Eden" "Ebony" "Donna" "Dora" "Doris" "Diana" "Danielle" "Daria" "Damita" "Camille" "Cara" "Carla" "Carmen" "Clarissa" "Chelsea" "Caitlin" "Bettina" "Blenda" "Bridget" "Briana" "Bella" "Becky" "Barbra" "Aldora" "Alysia" "Amorita" "Aretina" "Ara" "April" "Anita" } foreach badnick $badnickbase { if {[string match -nocase "$badnick*" $n]} { return "drone"; } } } proc kill_drone {n u c virus {blacklist ""}} { set hostname [lindex [split $u "@"] 1] if {$blacklist == ""} { set local_kick $::drone_kick set local_count [getuser $::drone_user xtra count] incr local_count setuser $::drone_user xtra count $local_count } else { set local_kick $::drone_kick_blacklist #set local_count [getuser $::drone_user " count] set local_count [getuser DroneDB xtra "$hostname_id"] } regsub -all "%virus%" $local_kick $virus local_kick regsub -all "%id%" $local_kick $local_count local_kick # TODO: Store info if {[getuser $::drone_user xtra "$hostname_id"] == ""} { setuser $::drone_user xtra "$hostname_id" $local_count setuser $::drone_user xtra "$hostname_virus" $virus setuser $::drone_user xtra "$hostname_first_nick" $n setuser $::drone_user xtra "$hostname_first_user" $u setuser $::drone_user xtra "$hostname_first_seen" [unixtime] } setuser $::drone_user xtra "$hostname_last_nick" $n setuser $::drone_user xtra "$hostname_last_user" $u setuser $::drone_user xtra "$hostname_last_seen" [unixtime] if {![botisop $c]} { putdebug "Bot not opped in $c, can't kick $n.." } else { putdebug "Kicking drone $n($u) in $c, infected with: $virus, id: $local_count" if {$blacklist != ""} { putquick "MODE $c +b *!*$u" putserv "PRIVMSG $n :Your computer appears to be infected with $virus. The channel $c is being pestered " putserv "PRIVMSG $n :with drones made to spam the channel. Please scan your computer with a virusscanner " putserv "PRIVMSG $n :like 02http://housecall.trendmicro.com/housecall/ 02." putserv "PRIVMSG $n :If, after that, you are sure you are not/no longer infected with a trojan/virus, please type 02/msg $::botnick removeme 02" } else { putserv "PRIVMSG $n :If you are sure you are not infected with a trojan/virus, please type 02/msg $::botnick removeme 02" } putquick "KICK $c $n :$local_kick" } } proc isZivCloneChan {chan} { global ziv_clonechans foreach ch $ziv_clonechans { if {[string tolower $ch] == [string tolower $chan]} { return 1 } } return -1 } proc isalpha {txt} { for {set i 0} {$i <= [string length $txt]} { incr i } { set c [string index $txt $i] if {[string match "*$c*" "abcdefghijklmnopqrstuvwxyz"] == 0} { return -1 } } return 1 } set ziv_clonechans { "#2on2" "#5on5" "#spielersuche" "#musik" "#matsi" "#musik.jam" "#3on3" "#cod.wars" "#3dv" "#clanmatch" "#pcw" "#musik.club" "#CS.Gather.DE" "#pracc" "#futurestation" "#ringer" "#4on4" "#musik.extreme" "#et.gather" "#clanwar.fr" "#clanwars.to" "#cs.vip" "#sponsorensuche" "#warfinder" "#SeekCw" "#try.se" "#faculty" "#pracc.se" "#ut.duell" "#mtw" "#esl.de" "#dc.eu" "#membersuche" "#omg.it's.a.pg" "#1on1" "#diablo2.trading" "#gamesports.de" "#ocrana" "#d-skyline" "#dkh" "#quakecon" "#Sk" "#the-titans" "#cs_reto" "#pracc1.6" "#mousesports" "#linux" "#doom3" "#cs.nu" "#mth.sb2" "#1.6" "#anime.fi" "#fragbite" "#eye" "#mysod" "#blackmusic" "#doom3.euro" "#rtg-clan" "#werbung" "#cs.gather.uk" "#esl.fifa" "#mth.sb" "#muropaketti" "#musik.inscene" "#pro-gaming" "#pgl.ro" "#ET-finland" "#highskilled.pcws" "#wow" "#gamers.fi" "#indoom" "#gamer-fm" "#ConceptT" "#hfd" "#mth.house" "#sicherheit" "#mTw.Elite" "#In.god.we.trust" "#pro-teams" "#lotw" "#techno4ever" "#cpl.world" "#musik.funky" "#royality" "#streetra3" "#sfto" "#C4-Grafix" "#callofduty.fi" "#search" "#naruto.fi" "#MOH.WARS" "#mth.sb3" "#nesl" "#diablo2.de" "#gw-news" "#esl" "#IchBinGeil" "#planetcod" "#airsoft" "#cs.gather.nl" "#fightzone" "#WeThePeople.radio" "#gamersnet.ch" "#esl.cod" "#paw.cs" "#gamebase" "#gameserv.dk" "#cadre" "#find" "#catch-gamer" "#wc3.fi" "#dayofdefeat.fi" "#a-losers" "#united-radio" "#clanbase.cod" "#mix.br" "#multiplay" "#exotic" "#mYSound" "#UT1" "#f7c" "#fop.hu" "#needclan.dk" "#cs.gather.fr" "#plan-b" "#team-amd" "#warfinder.dod" "#clanbase.et" "#Service4Free" "#sof2.games" "#wars.nl" "#cs.gather.pt" "#SEEKgood" "#WerbePlanet" "#zG" "#aq2suomi" "#4kings" "#cs.hu" "#debian.de" "#played" "#DaDevil" "#blank" "#clanbase.moh" "#iron" "#nF" "#lgz.match" "#myFi3$3L" "#Rendezvous" "#respawnkiller" "#needclan.no" "#64AMD" "#melody" "#planetquake" "#clan.23" "#zero.CLUB" "#Andromeda" "#found" "#surffi.net" "#xplayn.com" "#defusekids" "#Freeze-World" "#g4you" "#masterblasters" "#armateam" "#hx" "#Arcor" "#esl.cs" "#warcraft.de" "#bot4you" "#diablo2.ladder-1.10" "#sound.one" "#xdk" "#alpha-networks" "#BedO.GirL.and.Gather" "#clan-it" "#Galskap" "#kai_mulle_heruu" "#r60.org" "#b.tuned" "#clan.ukm " "#creAtive-Frags" "#nnscript" "#radioitg" "#metalradio" "#pelikaista" "#rcs.Support" "#cs.gamer-scene" "#end-cla" "#mymtw" "#stargate.fi" "#WildHost" "#BattleChat" "#hattrick.fi" "#utleague.pickup" "#bwgaming" "#Kzmaps" "#NordicRadio" "#pod" "#computerbase" "#deutschland.cs" "#gentoo.de" "#cs.co.il" "#gamebase.fi" "#GanG-FighterS" "#reunited" "#rhc" "#forze" "#halflife2" "#noa" "#steam" "#x6tence" "#daoc.prydwen" "#kiffen" "#mychance" "#teamNET" "#affe-clan" "#GamerSearch" "#nordichardware" "#slaughterhouse" "#talent" "#accesslevel" "#celticfist" "#ctfpickup.euro" "#doom3maps" "#scannerausleidenschaft" "#spull" "#boomtown" "#c++" "#vip`s" "#anti-cheat" "#bundesliga" "#bцhse.onkelz" "#cyberkingz.clan" "#de.redaktion" "#PHPBBMaster" "#airsoftkauppakeskus" "#anime.se" "#cs.gather.at" "#html.de" "#temp!" "#twr" "#ctfpickup.fr" "#excession" "#fnatic.Team" "#gsbot" "#RapKings" "#kuopio" "#omega-day" "#XonX.to" "#cum.at" "#galaXyStation" "#lanfinity" "#Daoc-de" "#jff" "#p-sound" "#planet-ng" "#swissGamers.ch" "#unknown" "#catz" "#gentoo" "#gewalt.gegen.hiphop" "#go2host.de" "#irc.sound" "#REMIX.FM" "#41er" "#cLuB.Fm" "#dod.gather" "#immortal.girls" "#justplay" "#radio.ZerO " "#stosstrupp-steiner" "#BeSSeRwUeRzEl" "#miXed.FM" "#moviem" "#shellfire" "#clanbase" "#cod-nation" "#justunreal" "#spixel" "#Xplosionz" "#allied-enemies" "#anime" "#cwl" "#Looney-Clan" "#sound-generation" "#stellar" "#ut2k4.mix" "#cnn" "#mixing" "#radio-orange" "#a-Lover" "#idlaa" "#ngl" "#promind.cc" "#trutm" "#anpe.games" "#BeTA.Gaming" "#bot-paradise" "#clustermixed" "#Elite-gts" "#masu-ownage" "#nX-Server" "#progaming" "#ut2004" "#audio" "#hit-city" "#Me-ladies" "#mywTm" "#q-clan" "#TO-patch" "#2online" "#bhkclan" "#biowar" "#clanbase.sof2" "#clanion" "#desertdevils" "#egn" "#gameserverprofis" "#musikgalaxy" "#privatservers" "#dignitas" "#planetwolfenstein" "#rilox" "#calvera`" "#hannover" "#it-medium" "#K@ozz" "#myrush" "#bvb09" "#m19" "#mesterhakker" "#puriX" "#resistance.cs" "#tecxx" "#csconfigs" "#csm.pcw" "#diablo2.se" "#dine" "#ephex" "#inunreal" "#java" "#lanparty.de" "#MrC" "#rtcw.no" "#69er" "#attax" "#ch.gath0r" "#dst-multigaming" "#gab" "#lupusagmen" "#naruto" "#sk.ut" "#suburban" "#Tranceland" "#unitedservers" "#64" "#ajojahti" "#cs.gather.es" "#Fabs" "#Levitation" "#lineage2" "#midnightUT" "#ra3pickup.se" "#rtcw:et" "#utopianer" "#ammo" "#eff-kult" "#et-liga" "#european-esports.eV" "#gsg-9" "#haju" "#my.mX" "#ckras" "#esl.wc3" "#mmac.united" "#ns.search" "#raggakings" "#sCip`" "#script.fi" "#soa" "#team-ger" "#werder" "#animefin" "#hдmeenlinna" "#saevus" "#servercamp" "#spontanctf" "#uk.radio" "#UT2K4.TDM" "#wishworld" "#epLix" "#gab.to" "#leaguez" "#nett.fm" "#nine-friends" "#osnabrьck" "#pms.girlsclan" "#ratboy" "#teamroyalty" "#ut.war-finder" "#ChanBot" "#clanbase.to" "#dkh.bf" "#nip.cs" "#PingiMonsteri" "#radio-in" "#rockclan" "#time2fear" "#2d" "#crowfire" "#empireuniverse" "#eXciTinG" "#G!schY" "#girlgaming" "#imperial" "#lastchance" "#pro.sports" "#warcraft3.no" "#check-it-out" "#ex-convict" "#japan" "#kiksuradio" "#Ladies@DkH" "#team-god" "#thezenith" "#tjado" "#ash" "#esl.ut" "#HLTV" "#nsfi" "#nukezone" "#teg" "#esports-world.net" "#extrem-gamers" "#g4bby" "#inzane" "#jubiigames" "#ksk" "#Lichtsche" "#MorbidFear" "#rentoremmi" "#seekwar.org" "#wow.fi" "#amish" "#chillside" "#endless.inspiration" "#Interstate" "#lisa-ownage" "#PUI" "#rapz-europe.net" "#rofl?" "#sodclan" "#VGonline" "#yakuza.gw" "#bnc4u" "#daoc.exc" "#darkgirl" "#DJґs" "#dumber" "#esports-total" "#fe-clan.net" "#lmp" "#mangz" "#ocrana.cod" "#overclocking.dk" "#proplay" "#PUB-CS" "#rentnerband" "#trance" "#clanbase.ut.insta" "#global-servers" "#landed" "#n2kill" "#suomi.hb" "#uhrwerk" "#yOshi-OwNaGe" "#1on1.esl" "#aachenfun" "#BFGeeks" "#campzone" "#d-G" "#D4rkY" "#e-Sport-Energy" "#edit" "#Flying-V-Clan" "#KoseBamse" "#mibr" "#point21" "#the-omen" "#CrashFM" "#FoCo" "#gg" "#gi.to" "#ischgebagga" "#scarleX" "#angeldust" "#clansol" "#ekspert" "#eXact" "#headшr" "#inwow" "#ladiez.hu" "#lan-nation" "#mathe" "#quake.se" "#Bodo" "#Channel-Bots" "#jathardware" "#ko.team" "#myD3NniS" "#noise" "#pwf" "#quakeworld" "#re-flex" "#sniper" "#teck-on1" "#unafraid" "#ut2004.jolt" "#Adarma" "#astralis" "#clanpla.net" "#cw.pl" "#dbd.no" "#eX-gaming" "#g4mes" "#game-foundation" "#idlerpg" "#nixblicka" "#radio.dimension" "#rafterman-script" "#remote.uk" "#royal.to" "#smuh" "#SoGi" "#team-a4o" "#Uptime" "#cpl.only.for.skilled.players" "#doom3.fi" "#frеgesport" "#hardstyle" "#jolt" "#mos" "#noobs.at" "#serveracademy" "#serverleih" "#syndicatewar" "#arrogan.se" "#battlefield.no" "#cod.battle" "#daoc-stonehenge" "#Databox" "#dof" "#Factory" "#ic" "#ironmaiden" "#junien" "#justmore" "#relaxed.wardogs" "#webhosting4all" "#weedbox" "#Wir-sind-das-Volk" "#Computerfreakz" "#csfi" "#dartmoor" "#esreality" "#GameServer.No" "#oS!" "#sfake" "#skede" "#x-X-x" "#xlnz" "#bjk" "#chaoskrieger" "#hdwi" "#lust" "#mouzfans" "#peli" "#testzol" } putlog "Drone Detector 2.0 active for: [join $drone_chans ", "]" if {$drone_debug != 1} { putlog "- Debugging is not activated." } else { putlog "- Debugging is activated." } putlog "- Database user: $drone_user" putlog "- Exemption flags: $drone_exempt_flags" return "Done"