G-Spot Bot

· Overview ·
· Origins ·
· Distribution ·
· Operation ·
· Detection and Removal ·
· Research ·

Overview

Vendor Notes:

 1.0: From the doc:
'G-Spot Bot v1.0 | Coded By J3NtiL; Scripts and Source from EvilCommunity Libraries. @co@
This is the first Version, so far as i know it works on every IRC Server. IF your new to IRC and have never used a bot before, Download mIRC and play with it first before using this bot. If your familiar with IRC I HIGHLY recommend using Invision for your IRC Client.
I will not answer any questions or emails concerning IRC or how to use it! There is an overflow of information on the internet on every aspect of IRC you can think of. IF you have found a bug in the prog or would like me to add a feature, dont hesitate to ask, im willing to add to the bot as much as possible and even make different bots that do different thinks to keep size down. To give input and suggestions DONT EMAIL ME!
Go to http://ILLCommunity.com, and post on the forum! The only emails i answer are those concerning the site. On the Forum you will receive help from every crew member, beta testers, and other bot users.
Command LIst... (ALL commands and passwords are case sensitive!)
!LOGIN ................Logs you in as bot owner.
!LOGOUT ................Logs you out of ownership.
!OPME ..........................The bot will give you op status, (reqires bot to be an op, and room registerd with chanserv)
!IP...........................Gives IP address of the bot.
!LOCK...........................Refuses all commands except !UNLOCK
!UNLOCK ................Unlocks the bot.
!BOTOFF..........................Shutsdown bot untill next reboot.
!KILLBOT..........................Removes bot from the system.
Now for the good stuff!
!FLOOD;;;
This is a simple icmp flood that was famous for killing windows 98 machines back in the day! Heres how it works. The maximum size of packets is 65500 anything more will not work. It will send 15 packets per second. so the next peram will be how many seconds to ping for, 60 will be around 1 minute at 15 packets per second. 86400 will take 1 day at 15 packets per second. If you have 5 bots, it will send 6480000 at 65500k in size in unfragmented packets, which will consume 4,244,4000 bytes of server resources per day! (Dont forget the (;) in between the variables!)
!SPIKE;;;;
Its a mix of icmp and igmp packet flood. It will flood exactly the same as above, but at the same time send a IGMP packet flood for the same amount of seconds with packets of the same size to a designated port. This will come in handy to plug up a port and consuming system resources while the system is begin denied service due to the ICMP flood. Almost perfect DOS that with enough bots can take down any router! (Dont forget the (;) in between the variables!)
!WEBGET;;
Just a simple web dloader, will downlaod then run the file. YOU MUST ADD A SAVE AS NAME!!! It will automaticallly save it in the systems dir. (Dont forget the (;) in between the variables!)
Features!
(1) Will wait for connection to log on to the server.
(2) Only allows 1 owner at a time.
(3) If a wrong password is entered 3 times the person will be kicked and banned from the channel. (ONLY WORKS IF BOT IS AN OP)!
(4) Can login and op itself (ONLY WORKS IF ROOM IS REGISTERD WITH CHANSERV!)
Feture versions will be decided on YOU! Tell me what you want and ill add it!
Im out! Its been fun!
~J3NtiL~

G-Spot Bot v2.0 .::. Coded By J3N7iL; Scripts and Source from EvilCommunity Libraries. @co@
IT's back and it "KICKS YO MAMA'S ASS!" :) at least i think so. I fixed the mimic bug that caused the bots to randomly repeat shit. It took a few times but thanx to our Awsome Beta Testers we found the problem. The bot alos runs faster and doesent eat up as much system recourses. I also gave it room to except multiple strings so that it wont miss commands or IRC PING's while executing commands. Go me!
IF your new to IRC and have never used a bot before, Download mIRC and play with it first before using this bot. If your familiar with IRC I HIGHLY recommend using Invision for your IRC Client.
I will not answer any questions or emails concerning IRC or how to use it! There is an overflow of information on the internet on every aspect of IRC you can think of. IF you have found a bug in the prog or would like me to add a feature, dont hesitate to ask, im willing to add to the bot as much as possible and even make different bots that do different thinks to keep size down. To give input and suggestions DONT EMAIL ME!
Added features .:.
1) You can choose the bots name and ident to give it a "non-Bot look".
2) As promised I added the web retrive setting. With this you can upload the settings.dll to a webserver and the bot will use those settings. This is great incase you get banned, the bots get banned or the server dies!
3)Chan key added. I have no excuse why i dident add it in the first version, but it's here now.
4)the bot has more server controlls with chanserve like ...
.:.Auto Op
.:.Mark as Inivisable (it marks the bot invisible, but i can still see it) bug?
.:.Wallops directs all wallops msg to bot.
.:.hide room : hides room
.:.Set to Privit : Make room private
.:.Oponly : Alows only ops to chat
.:.no out side msg : denies all out side msg
Command LIst... (ALL commands and passwords are case sensitive!)
!LOGIN ................Logs you in as bot owner.
!LOGOUT ................Logs you out of ownership.
!OPME ..........................The bot will give you op status, (reqires bot to be an op, and room registerd with chanserv)
!VERSION ...........................Gives the bot's Version.
!IP ...........................Gives IP address of the bot.
!LOCK ...........................Refuses all commands except !UNLOCK
!UNLOCK ................Unlocks the bot.
!JOIN ; <#channel>................Will Join another channel. (DON'T FORGET THE ';')
!SAYIT ; ................Wil say what you tell it to. (DON'T FORGET THE ';')
!BOTOFF ...........................Shutsdown bot untill next reboot.
!KILLBOT ...........................Remove bot from vic completely.
!CDOPEN ...........................Opens CD-Rom.
!SHUTDOWN ...........................Suts Down vics PC.
!RAW ; ............Sends RAW commands to IRC. (DON'T FORGET THE ';')
!ICQ ; ...............Sends bot info to the ICQ number.(good for inviting freinds to play!) (DON'T FORGET THE ';')
!VISIT ; .................Sends the vic to the url.
Now for the good stuff!
!FLOOD;;;
This is a simple icmp flood that was famous for killing windows 98 machines back in the day! Heres how it works the maximum size of packetts is 65500 anything more will not work. it will send 15 packets per seconde. so the next peram will be how many seconds to ping for, 60 will be around 1 minute at 15 packets per seconde. 86400 will take 1 day at 15 packets per seconde. if you have 5 bots, it will send 6480000 at 65500k in size in unfragmented packets. wich will consume 4,244,4000 bytes of server resources per day! (Dont forget the (;) inbetween the variables!)
!SPIKE;;;;
Its a mix of icmp and igmp packet flood. It will flood exactly the same as above, but at the same time send a IGMP packet flood for the same amount of seconds with packets of the same size To a designated port. This will come in handy to plug up a port and consuming system resources while the system is begin denied service due to the ICMP flood. Almost perfect DOS that with enough bots can take down any router! (Dont forget the (;) inbetween the variables!)
Features!
!WEBGET;;
Just a simple web dloader, will downlaod then run the file. YOU MUST ADD A SAVE AS NAME!!! It will automaticly save it in the systems dir. (Dont forget the (;) inbetween the variables!)
Features!
(1) Will wait for connection to log on to the server.
(2) Only alows 1 owner at a time.
(3) If a wrong password is entered 3 times the person will be kicked and baned from the channel. (ONLY WORKS IF BOT IS AN OP)!
(4) Can login and op itself (ONLY WORKS IF ROOM IS REGISTERD WITH CHANSERV!)
Feture versions will be decided on YOU! Tell me what you want and ill add it!
Computer games don't affect kids. If Pacman affected our generation as kids, we'd all run around in a darkened room munching pills and listening to repetitive music.
.: J3N7iL :.

Alias:

 Backdoor.G_Spot.10, Backdoor.G_Spot.15, Backdoor.G_Spot.20

See Also:

 Gspot

Category:

Backdoor: A secret or undocumented means of getting into a computer system, or software that uses such a means to penetrate a system. Some software has a backdoor placed by the programmer to allow them to gain access to troubleshoot or change the program. Software that is classified as a "backdoor" is designed to exploit a vulnerability in a system, and open it to future access by an attacker.

Variants:
  • G-Spot Bot 1.0
  • G-Spot Bot 1.5
  • G-Spot Bot 2.0
    		•

    Similar Pests:

    		 Backdoor

    Origins

    Author:

    		 J3N7iL

    Group:

    		 EvilCommunity Libraries

    By This Group:

    		 Gspot ·

    Date of Origin:

    		 Variants from January, 2002 to April, 2002

    Distribution

    Prevalence:
  • G-Spot Bot 2.0: 0.3%
    • More Info

    Clot Factor:
  • G-Spot Bot 2.0: 2

    • The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.

    Countries Affected:

    		 In the past three months, we have received reports of G-Spot Bot in Switzerland, United States.

    Growth:
  • G-Spot Bot 2.0: Insufficient data to report growth
    		•

    Operation

    Storage Required:
  • G-Spot Bot 1.0: at least 1801 KB
  • G-Spot Bot 2.0: at least 441 KB
    		•

    Restart:

    		 HKLM\Software\Microsoft\Windows\CurrentVersion\Run "VideoDriver"
    Autostarting Pests

    ScreenShot:


    G-SPOT IRC BOT 1.0


    G-SPOT IRC BOT 1.5


    G-SPOT IRC BOT 2.0

    Detection and Removal

    Automatic Removal:

    PestPatrol detects this.

    PestPatrol removes this.

    Manual Removal:

    		 Follow these steps to remove G-Spot Bot from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.
    Stop Running Processes:

    Kill these running processes with Task Manager:

    Remove AutoRun Reference:

    Go To the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.
    If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\videodriver, delete it and reboot the machine immediately.



    Unregister DLLs:

    Unregister these DLLs with Regsvr32, then reboot:

    Clean Registry:

    Remove these registry items (if present) with RegEdit:

    Remove Files:

    Remove these files (if present) with Windows Explorer:

    Research

    File Analyses:

    More Info:
  • AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
    		•

    Research By:
  • PestPatrol's Pest Research Center
    		•

    Last Revised:

    		 April 03, 2005