K:lined

[sdOK]

I have been K:lined from efnet.
I logged in today and got immediately k:lined.
efnet.demon.co.uk- *** Banned Temporary K-line 1440 min. - DNSBL listed. Check ircnet.com/cgi-bin/bl.cgi?ip=85.210.42.212 for removal. (2006/1/11 13.23)
I check on that site and it says - IP Address 85.210.42.212 was found in the CBL.

It was detected at 2006-01-05 16:00 GMT (+/- 30 minutes).

A recent Sober worm variant is causing considerable havoc on the Internet. This particular variant sends out email allegedly from the FBI or CIA (amongst other things). It is known by anti-virus companies under several different names: Sober.U (eg: ClamAV), Sober.Z (eg: Sophos) and Sober.X (eg: Symantec).

I scanned for sober or any other virus and found nothing at all.
Can I find more info as I dont want to just get K:lined for another 24 hours without having any idea what is causing it.

[JustHavinFun]

Hi, I'm getting exactly the same problem.

Can this be sorted out please?

[lucy]

did you go to the url listed in the kline message?

[sdOK]

yes and nothing has changed. I am still k:lined on most efnet servers.
I found one in israel that lets me on.
While i am on this server is there somewhere to get hold of ops?

[lucy]

/stats p the server and it will tell you ircops on that server and their idle time

[munky]

you have to do more than just visit the URL. you have to go to the URL and read the directions on how to request removal from the blacklist. since you are listed in cbl, visit http://cbl.abuseat.org

though, currently when i search the blacklists, that IP does not appear

[sdOK]

No it must have been removed. I am not k:lined now.
Its a bit worrying though as I have changed nothing bar scanning my pc like mad looking for non existant trojans etc. I just use basic mirc with no scripts/bots. My pc is virus scanned every day.
I understand with the weight of people using efnet that it is impossible to keep track of every banned user but I did absolutely nothing. Just logged on and got k:lined. No explanation. Makes you wonder though. Have I upset somebody? Is someone out for me now? Was it just random fate singled me out?

[Pills]

You did nothing to anyone; your IP was listed on that list. It was looked up, and banned. No user (oper) involvement.

[JustHavinFun]

Hi guys I am still getting the kline: My ip is obviously contained withinn the list. When I go to the URL there are no instructions, just various options and info regarding my ip such as traceroute, host, domain. Sort of like dnsstuff.com

Any ideas?

Thanks

[munky]

according to http://cbl.abuseat.org/lookup.cgi?ip=194.82.121.38

scan your system with http://securityresponse.symantec.com/av ... .tool.html

[JustHavinFun]

My system is fine, I formatted it quite recently :/

[JustHavinFun]

Hey, could somebody please assist me in this matter? I'm on a University network so it could play a small part although I'm not 100% sure.

Thanks

[lucy]

did you scan your system like munky suggested?

have you gone to the server list and tried other servers?

[wundr]

Hey, could somebody please assist me in this matter? I'm on a University network so it could play a small part although I'm not 100% sure.

Thanks

It could play a large part if your uni has you on a NAT. This would mean that a number of people all use the same external IP, so if any of them have a virus, then you may get banned for it, too (because you are coming from the same IP). You can check this by going to Start-->Run, typing 'cmd', then in the box, ipconfig. If your IP is a 192.168.x.x or 10.x.x.x IP, then you are probably behind a NAT.

The blacklist's web site says it was last detected on January 12th, so your recent format may not have helped...

EDIT: The CBL's web site now says about your IP: "It was previously listed, but was removed at 2006-01-14 11:59 GMT"... seems you have been delisted successfully. Congrats!

[JustHavinFun]

Brilliant... it works now ....

irc.efnet.nl

woohoo