Channel Review - #Nohack
With the growing popularity of the Internet, the impact of malicious virii and trojans has become ever greater. The modern-day virus often makes use of IRC protocol as an easy medium through which the miscreant can access and control his victims’ computers.
Since the days of script.ini, DALnet has been seeing the fallout from this wave of Internet crime, and thus the Exploits Team, a group of individuals dedicated to combating the problems infected machines can cause, was created. From these humble beginning sprang a channel known as #Nohack. Founded in 1997 by Casteele, and later turned over to PinBallwiz, this channel provided hands-on help to DALnet users infected with script.ini . On January 15, 1998 #Nohack was declared an offical DALnet help channel.
Since those early days, #Nohack has grown to become the most successful channel of it’s type on DALnet. The team of volunteer helpers there deal with many aspects of exploits such as virii, trojans and IRC scripts containing malicious code and backdoors. In most cases the help they provide is practical and hands-on; walking users through a process of detection and removal of the malicious files which are plaguing them. They can also provide a wealth of information and sources to help the user learn more about their own computer security, as well as find the right tools to keep their systems secure.
To get the low-down on #Nohack, we tracked down the IRCop Fruit^Loop, a #Nohack Sop and member of the DALnet Exploits Prevention Team.
Q: If certains users wish to become "official" helpers within #Nohack what training and things would they need to go though in order to be able to help?
A new quiz is being derived now, and the helper would need to pass that quiz. Any helper would need to have a general knowledge of windows based operating systems. Knowledge of the MIRC client is a benefit as well, as some infections can be cleaned by using MIRC’s scripting. If I was to give advice on learning virii, trojans and exploits it would be one major thing “SEEK information” Info is available all over the net and is easily obtained. Myself and fellow SOP temptme took a lot of time looking and looking for information on things and that’s how we learned. Its not just a skill that one just obtains naturally at all.
Q: Do you sometimes find it hard to cope with all the fuss/chaos in the channel when people are screaming about viruses/whatnot?
Indeed, and I think its fair to say all the ops feel that way. Most things we help with require one on one help. This means users need to be patient and wait their turn. However most users panic and scream “why wont you help me.” The fact is we will help, when we finish the user we are working with. Sometimes this may be a longer of a wait depending on the need of the user in need. Mind you normally there is 2 ops and 8-10 users at one time in the channel, so you see we have a lot of work to do if we want to help each and every user, and we do want to
help, that’s why we are there.
Q: What do you think is the most annoying or destructive virus/trojan you ever had deal with in #Nohack?
CIH would be the virus that I didn’t like to deal with as it was very destructive.
As for the Trojan I’d say the recent attack of Global Threat bots that are infecting
Multiple users on IRC. Its not destructive per say, but a large annoyance.
Q: How closely do you work with external websites in the attempt to control the number of clients being infected?
We work with many hosting companies and ISP's as well not to mention AV companies.
Q: What improvements do you think if any that #Nohack need to talk in order to ensure everyone is dealt with efficiently and correctly?
The ops are well informed and are very receptive . I’d have to say we are a rather hard channel to get ops in as the knowledge you need to be an op in there is very unlike many other help channels on dalnet, for example there is no /help or /help thistrojanvirus here.
We know what to do and if we don’t we say it , there is no way anyone can know every problem out there in “virus world”. My only suggestion for ops and helpers is this: #Nohack can be overwhelming and cause burn out. So when you get stressed, tired, angry ..'Leave' . Take a break , walk away , and come back when your able to deal with it. We don’t want to lose ops due to burn out, and this can and has happened.
Q: Finally what would you recommend people do in order to keep their systems clean?
Use a firewall. Get the Conseal Firewall Trial Version for Windows95/98 - fill out the form to download Conseal firewall.
Get the Free ZoneAlarm Firewall to block attacks on your computer.
Use an UPDATED antivirus, or even two, as NO AV can detect every worm,virus or exploit that is out there. You can download McAfee VirusScan (30-day evaluation) to scan for and remove any viruses on your computer.
You can get F-Secure Anti Virus.
Download Norton's Antivirus. You need to click Download, then fill out a form.
For a totally Free antivirus Go to www.grisoft.com
Know your computers files, this way you may notice a change or a new file that has been made due to a virii, and above all, do NOT accept files from anyone you do not know, this is not limited to just IRC, beware on ANY chat client, email or website that one directs you to.
A Trojan scanner is also recommended.
Swat It
Cleaner
Always check for critical Microsoft updates.
Angelwink's final words:
If you thought that #Nohack was a place to rest, chat and socialize, well I would suggest you think again. I speak from experience when I say helping there can indeed be overwhelming and requires loads of patience.
DALnet is in no manner held responsible for any virii or trojans which you may become infected with during the course of your IRC sessions or otherwise. If you suspect your chat client is infected with a virus/trojan that propagates itself via IRC, I speak on behalf of #Nohack and DALnet staff when I say we urge you not to disregard the issue but to join #Nohack and seek help from the operators and recognized official helpers.
#Nohack's website can be found at http://www.nohack.net, along with the channel guidelines, the history of the channel, the training outlines & Quiz, and the list of staff and contacts etc.
Last but not least, I'd like to applaud all the accomplishments of #Nohack's team since its creation and I'd like to thank Pinballwiz for allowing us to review the channel and Fruit^Loop for the time given to answer all these questions and share some great information with us. We wish you all many more years of success on DALnet.
If you know any channel that's interesting and worth a review, email us at zine@dal.net. Considering the vast number of channels formed on DALnet, we will only pick certain ones, however your suggestions and contributions are highly appreciated. Thanks for your understanding and support.
©Angelwink 2002
