IRC bots

[erikguy]

Does anyone know if avast! has a good detection of IRC bots and worms? I hear there is a lot on that network. I haven't setup an IRC account yet but I want to know if avast! will protect me if and when I do. Also, I was kind of curious to know if Alwil will ever put out a seperate anti-spyware application? I know avast! has a few spyware signatures but wouldn't a seperate program be more effective?

[Eddy]

Avast has several ways to check the IRC traffic.

Resident (real time protection):
1] The on-access provider
2] The IM (Instant Message) provider


Non resident:
1] on-demand scan

[erikguy]

Right. But that doesn't quite answer my question. I meant, is there plenty of IRC malware in its database?

[Eddy]

Why not have a look at the virus database and see for yourself?

[igor]

Btw, maybe I visit "wrong" network / channels, but personally I've never met a single virus on IRC, as far as I remember.

[pk]

Some backdoors are used to join a channel on IRC network and if their creator connects to the same channel (e.g. protected by password) it can write commands to control your computer. But this backdoor is like other ones - they can be still detected by avast (it doesnt matter what type of communication they use).

[erikguy]

Why not have a look at the virus database and see for yourself?

Yes I have looked at the VPS history and I do see some IRC crapware in there but I have no idea if that's a good slice of the whole you know what I mean?

Some backdoors are used to join a channel on IRC network and if their creator connects to the same channel (e.g. protected by password) it can write commands to control your computer. But this backdoor is like other ones - they can be still detected by avast (it doesnt matter what type of communication they use).

Yeah, but there is some malware specific to IRC right? That you wouldn't encounter anywhere else? I'm just wondering how avast! does with these....  Well anyways, thank you all for your responses.

[Eddy]

Yes I have looked at the VPS history and I do see some IRC crapware in there but I have no idea if that's a good slice of the whole you know what I mean?

What is enough? There are many Avast users that also use IRC, and they trust Avast in this. So you can say it is enough. On the other hand, not everything is detected. But this goes for all av's. And there will never be a application that detects all malware. If you keep this in mind you could say it is never enough. But keep also in mind that the detection rate is growing and growing.

So my initial question should actullay be: "Is it enough for you (the user)?". Personally I work with IRC a lot, and I know that with a good IRC script you can even further more lower the risk of an infection. I use PnP, (Peace aNd protection) script. I use several networks, and sofar no malware came through my defenses. Thanks to my script and Avast.

note: defense (ofcourse) depends also on what settings you as user make in a application.

[John-]

I know what you are tryint to say,...but really,...

Catching a virus on IRC is only possible in following ways:

- DCC traffic (always turn on "show warning" if you receive a DCC request or ignore them all) (when using mIRC)
- IRC bots can send you pm's with hyperlinks which refer to malicious files like  http://yaddayadaa/this_jpg_is_infected.jpg. It's up to you if you click on them or not. I recommend you to use Firefox instead of IE, cause most of these "virusses" are  harmless when using Firefox.

Anything else but that virus infections by simply chatting is not possible.

There are some scripts that, if you click on them when you receive them private, a user can chat with your
nickname,.... but,...that's it

If you want to be more safe,...use a BNC with additional vhost:
this is what you see if you performa a /whois command on me on IRC:

So, if somebody would perform a /dns he would get the IP off the Linux server where my shell is installed!
So he or she will not get your home IP!

hope this helps,...