The Bot and a Quickie
I’m sorry I was unable to post our Friday Quickies yesterday. My daughter was in town and we had a family gathering planned. I did a big pot of stew and all the “mommy” kind of things I haven’t done in years! 
So, I hope you’ll forgive me!
First a Quickie….
Do you remember my Halloween post where I took all the spam in my inbox and made a ‘mad libs’ kind of post? (In case you missed it: Halloween Fun with Spam)
Well, a twitter friend of mine – Rex Hammock – did the same thing a bit differently. His blog post is called, If Spammer’s Created my Christmas List. If you’ve been the brunt of the recent round of spam, you’ll find this pretty amusing!
The RUBotted Saga Continuing….
We’ve had many more responses to this RUBotted pop-up situation. It appears we’ve narrowed down the software that the sites are trying to launch as an IRC (Internet Relay Chat or Instant Messaging Program).
I would like you to comment to this post if you’ve received the RUBotted pop-up message and if you have any kind of Instant Messaging installed on your computer. Oh, wait a minute! Everyone who uses Windows has Windows Messenger installed! Hmmmmmmm…..
Okay, well I know I have Yahoo Messenger but I don’t use it. I do use my Google Chat and that’s always running in the background. I used to have Windows Live Messenger but I don’t use that either.
I just checked my services and my ‘Messenger’ is disabled. (I did that on purpose.)
However, there’s iTunes service running, Bonjour, and that stupid Mobile Device Manager running.
So, what’s running on your machine? If we can put our heads together, maybe we can figure this out!
Comments welcome!
6 Responses to “The Bot and a Quickie”
Leave a Reply
 |
 |
 |
|
||
 |
|
 |
|
||
I’ve been getting the RUBotted pop-ups for the past month or so, and every single time it has been whenever I connected to IRC through my IRC client (mIRC). At one point, I was even able to predict the pop-ups, as they would occur 10 seconds after I had entered a message.
Whenever I’m not using IRC – and admittedly, that includes surfing somewhat dodgy websites – RUBotted wouldn’t give a squeak, but the moment I start IRC, it.starts popping up.
Reply
Facebook User reply on December 8th, 2008 10:10 am:
@KD Larsen, Thank you so much for that! This would make it seem like a ‘quirk’ or ‘bug’ in the RUBotted program then. Perhaps I am a bit too paranoid?
Reply
The only instant messaging I’m running is mIRC – I don’t use any other messaging software. The warnings come only when mIRC is running. And if I disable RUBotted’s monitoring of IRC requests, the warnings stop. RUBotted never objected to mIRC until this saga started a couple weeks back.
That said, twice in the past week, I’ve received warnings from RUBotted that mention malicious DNS queries. Once mIRC was running, once it wasn’t. And still HouseCall, AdAware, Spybot, and AVG are finding nothing wrong.
I’m beginning to wonder if TrendMicro has merely defined any instant messaging server or any IRC traffic as automatically “malicious”, resulting in a lot of false positives for malware.
Reply
Facebook User reply on December 8th, 2008 10:13 am:
@gospazha, Your response seems to be falling in line with KD Larsen’s response too! Let me do some more checking and see what I can dig up. But it’s looking more and more like a bug in the software. What’s odd is that I never had this beta version update itself. So why now? That’s the question I want answered. Why all of a sudden are we getting this? Thanks so much for your comment!
Reply
It is definately odd that is is showing up recently. If RUBotted has never updated, which I don’t think it has then something must have changed some how. My guess is that RUBotted talks to a master server with IP address information and it has added IRC servers into the blocked/banned list of IPs.
For me this is getting rather irritating as we haven’t had any update. Can’t find any offical information on trend’s website. It is making this product look really stupid and I’m about to dump it.
Reply
Facebook User reply on December 8th, 2008 2:15 pm:
@Ddraig, Check out my new post today. This is indeed getting more interesting!
Reply