What really happend on the temp-channel disaster

Two and a half years after disaster struck temp-channel on one sunny afternoon, I decided to let out the truth of what really happend that day.
Here is my Conspiracy Theory!
* The following events are in chronological order.

Episode 1

It all started on the evening of March 31st 2004, one day before the notorious April Fools.
Paradoxx starts off with a warning! a forecast to the future.
(23:14:13) (@_Paradoxx) New virus. (jpg style)
(23:14:29) (@rlz) Dope.
(23:14:42) (@_Paradoxx) if you see this message “u wanna see my site? hffp://private.a123sdsdssddddgfg.com” don’t click it!
Everyone chooses to ignore it and take it lightly.
temp-channel is consisted of a very carefully picked group of leet-haxors, who are > trojans.

Later on shows up Savior a.k.a Savoir a.k.a Savor.
Savior starts off with a little whine and a call-out for sympathy.
(00:02:52) (@eSr^eXc-Savush) my ankle status is really bad
(00:02:56) (@eSr^eXc-Savush) i can barely walk :/
rlz giving a shit:
(00:03:38) (@rlz) :-/
Savior tries to find ways how to cheer himself up and finds this… A joke page! What’s a better way to cheer yourself up than a few laughs?
(00:06:59) (@eSr^eXc-Savush) http://jokes.clubdepeche.com/
(00:07:00) (@eSr^eXc-Savush) :/
And… Savior with a nostalgic temp-channel line
(00:17:27) (@eSr^eXc-Savush) cat i’m a kitty cat and i dance dance dance
And…… Savior showing off some leet Intarnet Elper skillz
(00:18:05) (@eSr^eXc-Savush) keeteh hm h eeteh at dn h aence anec anec
(00:18:15) (@eSr^eXc-Savush) :D:D
Very mature.
Hmm, hold on. I think he’s trying to say something important here
(00:20:14) (@eSr^eXc-Savush) oobz h pe uo eednt puhwesses aht ing :(
What’s that? We don’t read engrish
(00:20:19) (@eSr^eXc-Savush) semek :/
(00:20:32) (@eSr^eXc-Savush) i hope u didnt press that link
(00:20:33) (@eSr^eXc-Savush) :/
Is that so? Why? rlz getting curious
(00:22:56) (@rlz) Which?
(00:23:07) (@eSr^eXc-Savush) the jokes thing
(00:23:08) (@eSr^eXc-Savush) :/
(00:23:16) (@rlz) I didn’t.
(00:23:19) (@eSr^eXc-Savush) yat
(00:23:21) (@eSr^eXc-Savush) yay
(00:23:21) (@eSr^eXc-Savush) :/
(00:23:57) (@rlz) What’s wrong with it?
Savior explains
(00:24:18) (@eSr^eXc-Savush) (00:15:59) (@angel-) ahahahahaha http://jokes.clubdepeche.com
(00:24:19) (@eSr^eXc-Savush) (00:16:00) —› quit: (angel-) (~nir_shabi@Angel—.users.quakenet.org) (Killed (*.quakenet.org (You are violating QuakeNet rules. Please read http://www.quakenet.org/rules/. ID: 2649387)))
(00:24:19) (@eSr^eXc-Savush) (00:16:48) ([00]Escaflowne) http://jokes.clubdepeche.com
(00:24:40) (@eSr^eXc-Savush) (00:21:31) (eSr^eXc-Savush) lol
(00:24:40) (@eSr^eXc-Savush) (00:21:32) (eSr^eXc-Savush) :/
(00:24:40) (@eSr^eXc-Savush) (00:21:43) (eSr^eXc-Savush) i forgot it’s april fools
Looks like Savior is patient zero on the temp-channel attack!
(00:24:46) (@eSr^eXc-Savush) should be fun :D:D
(00:25:09) (@Prophecy`) mashehu
You have no idea…

Episode 2 – Part 1

gm @ temp-channel
(11:29:40) (@eSr^eXc-Raist) hua
sup Raist…
(12:53:28) (@eSr^eXc-Raist) rlz rlz
(12:53:31) (@eSr^eXc-Raist) >:DD
(12:53:54) (@rlz) :o
(12:54:03) (@eSr^eXc-Raist) http://people.freenet.de/nathalie/me.jpg !!! Lol
(12:54:03) —› quit: (eSr^eXc-Raist) (Raistlin@shtok.shtok.ya.kabab.org) (Killed (*.quakenet.org (You are violating QuakeNet rules. Please read http://www.quakenet.org/rules/. ID: 2650573)))
uh-oh, that doesn’t look good. Could it be that Raistlin got himself a new virus?
(12:56:21) (@rlz) Good job, you got yourself a new virus.
(12:56:34) (@rlz) 12:55:00 <@eSr^eXc-Raist> http://people.freenet.de/<censored>/me.jpg !!! Lol
Lol indeed.
(13:00:28) (_testbnc_) yey
(13:00:38) (_testbnc_) i helped taking over excession
(13:00:38) (_testbnc_) :
(13:00:39) (_testbnc_) \
(13:00:46) (_testbnc_) lahatzti al “virus” link
(13:00:47) (_testbnc_) ;\
wtg nubinator.
Seems like somewhere between 12:54 and 13:00, Raistlin was infected with some new virus, and helped taking over #excession.
What link did Raistlin click on? Maybe Savior’s link from last night? Possibly. We’ll get to that.
In the meantime, Raistlin warns the members of temp-channel he might be a threat to the channel’s existence
(13:11:08) (Raistlin`-) help :\
(13:12:30) (Raistlin`-) remoev my +av
(13:12:41) (Raistlin`-) +ao
ssj in response
(13:24:24) (@eSr^eXc-ssj-) remove him all toghter , from irc, he should be using tapoz not irc
(13:24:28) (@eSr^eXc-ssj-) he is to newbie for irc
Couldn’t agree more.
(13:25:37) (@eSr^eXc-ssj-) ronen single handedly banned 250 users from excession channel
(13:25:41) (@eSr^eXc-ssj-) everyone tell him gj
gj.
Anyway, Raistlin! What kind of link did you hit?
(13:26:15) (Raistlin`-) loc
(13:26:17) (Raistlin`-) [13:19:36] <ButtleScreaM> http://people.freenet.de/nathalie/me.jpg !!! Lol
(13:26:19) (Raistlin`-) that link
(13:26:19) (Raistlin`-) :\
(13:26:21) (Raistlin`-) tire ma ze; \
Ok so you hit the “nathalie/me.jpg” link you found somewhere… sure wasn’t pasted in temp-channel before the infection.
Can’t blame ButtleScreaM as well because the above paste is from 13:19, long after the excession attack.
The only explanation is that Raistlin got the link from somewhere outside the channel.

Episode 2 – Part 2

Just a minute before that, a second frontier opens! Another attack hits temp-channel!
(13:25:02) (@eSr^eXc-ssj-) hmm
(13:25:06) (@eSr^eXc-ssj-) nice , gam le nir yesh ?
(13:25:13) (@rlz) I bet he faked it.
Did he fake it? sadly he didn’t.
(13:28:59) (@^power) hara
(13:29:23) (@^power) gam ani hizdayanti?
(13:29:45) (@rlz) 13:25:44 <@^power> u wanna see my site? http://private.a123<censored>.com
(13:29:54) (@^power) zain
Looks like ^power got infected with the “private.a123” virus, the same one Paradoxx forewarned about, early the night before.
^power was infected at precisely 13:25 – 31 minutes after Raistlin’s infection.
rlz, as a true defender of the force, jumps immediately to the rescue
(13:29:54) (@rlz) I got removal instructions for that one.
(13:29:56) (@rlz) Somewhere.
(13:29:58) (@rlz) Hold up.
As you can see, 2 different types of worms attacked temp-channel.
1st was Raistlin’s “nathalie/me.jpg”.
2nd was ^power’s “private.a123”.
(13:30:46) (@rlz) 08:29:42 <[NOTICE]> WARNING: There is a new IE exploit going around, DO NOT click on any url that contains *private.a123sds* *jokes.club* or *horny.69* even
(13:30:49) (@rlz) if you trust the person. If you have clicked on the url, you are infected. Please visit
(13:30:52) (@rlz) http://www.terrorfactor.com/IRCBot.trojan.fix.html for the instructions on how to clean yourself. THIS IS NOT A JOKE.
Now it makes sense. ^power, like a natural scroll-up’er, hit Savior’s jokes link before he could notice the warning about it. gg.
Note that the WARNING doesn’t prompt for URLs such as “nathalie/me.jpg” – the one Raistlin’s infected with.
However, that doesn’t stop him from trying to fix it that way.
(13:31:16) (Raistlin`-) sec ani oleh livdok ma omrim sham
rlz concurs the fact – there are 2 types of worms.
(13:31:17) (@rlz) Raistlin`-: That probably won’t help you. You got something else.
Raistlin, stubborn as always, keeps on…
(13:31:32) (Raistlin`-) u hav ethe link i gave u mikodem ?
(13:31:34) (Raistlin`-) ze ma lahatzti
(13:31:35) (Raistlin`-) natalie
(13:31:35) (Raistlin`-) ;\
(13:31:39) (Raistlin`-) nu ani omer lahem
(13:31:43) (Raistlin`-) ze hiber oti le server
(13:31:46) (Raistlin`-) ve shalahti ta link
(13:31:53) (Raistlin`-) ta user info i mean
(13:31:55) (Raistlin`-) le q
At this point it should be noted that ^power’s virus didn’t do anything like that.
^power has been using his own Q auth since he joined Quakenet. It was never stolen from him.
ssj with an anecdote
(13:31:58) (@eSr^eXc-ssj-) they should replace the If you have clicked on the url, you are infected. Please visit with if you have clicked the url , format your computer and quit irc forever
Then Prophecy must’ve been infected too! since he has indeed quit irc forever :'(
Back to our subject… Still need proofs?
(13:32:23) (Raistlin`-) : Do [CTRL]-[ALT]-[DEL] and ‘End Task’ the process “wsz32.exe”
(13:32:25) (Raistlin`-) i did not have it
(13:32:37) (@rlz) I already said, you got something else. I lie not.
(13:32:41) (@eSr^eXc-ssj-) yeah you have the 2nd best thing
Raistlin.. IT’S NOT THE SAME VIRUS SO GIVE IT A BREAK.

Episode 3

A while after the storm settles… comes another explanation of what happend to poor ^power
(13:59:46) (Raistlin`-) nir ya tembel eih ata nofel be kol ha virusim ha ele
(13:59:47) (Raistlin`-) :\
(14:00:07) (@^power) Savi made me press it.
(14:00:11) (Raistlin`-) rofl
(14:00:14) (Raistlin`-) savi gam nagua ?
(14:00:21) (@^power) I think so.
(14:00:28) (@^power) He pasted that jokes link here.
(14:00:30) (@rlz) Uhh…
(14:00:36) (@^power) It was last night tho.
(14:00:50) (@rlz) Oh, right.
(14:00:53) (@^power) Then he was like, “Uhh.. I hope you didn’t press that jokes link”
proven again, ^power hit Savior’s link and got infected.
Raistlin looking for someone to blame. Naturally he’d blame the one who linked him to the page, tho…
(14:10:00) (Raistlin`-) nir
(14:10:05) (Raistlin`-) nachon ze ashmat ran?
(14:10:12) (@^power) Heh, lama?
(14:10:19) (Raistlin`-) [14:06:39] <Raistlin`-> ze ashmat ran
(14:10:19) (Raistlin`-) [14:06:46] <Raistlin`-> he uses mozila and he didnt bother to tell me why
(14:10:19) (Raistlin`-) [14:06:46] <Raistlin`-> !
Why don’t you blame the guy from temp-channel who you’re claiming to have pasted you the link?
Prophecy comes to laugh @ nubish us
(17:44:21) (@Prophecy`) LOL
(17:44:32) (@Prophecy`) ronen gave some nice virus ? :)
(17:44:33) (@Prophecy`) gadol
(17:44:39) (@_Paradoxx) :\
(17:45:03) (@^power) Ronen, and I suspect Danton too.
(17:45:44) (@_Paradoxx) ze hakol ethil be savi
(17:45:45) (@_Paradoxx) :|
As proven, savi started the “private.a123” virus.
It was Ronen who started the “nathalie/me.jpg” virus and was the only one infected with it in temp-channel.
A day later, Tibby pays a visit
(13:20:14) (@eSr^eXc-Tibby) hi
(13:20:14) (@eSr^eXc-Tibby) :/
v.hi
ssj filling him in about the latest happenings
(13:20:19) (@eSr^eXc-Tibby) tagid
(13:20:20) (@eSr^eXc-Tibby) lemi amru
(13:20:22) (@eSr^eXc-Tibby) et:
(13:20:25) (@eSr^eXc-Tibby) STOP USING IE, YOU PRICKS! USE MOZILLA FIREFOX!
(13:20:26) (@eSr^eXc-Tibby) ve lama
(13:20:31) (@eSr^eXc-ssj-) ronen got a new virus
(13:20:35) (@eSr^eXc-ssj-) and had to format his computer
(13:20:38) (@eSr^eXc-Tibby) :/
(13:20:40) (@eSr^eXc-ssj-) also he manage to give some ppl
(13:20:42) (@eSr^eXc-ssj-) his Q auth
(13:20:44) (@eSr^eXc-Tibby) lol
(13:20:47) (@eSr^eXc-ssj-) and bann all the ppl from excession
(13:20:50) (@eSr^eXc-ssj-) and esrael
(13:20:52) (@eSr^eXc-Tibby) loool
(13:20:52) (@eSr^eXc-ssj-) AND
(13:20:54) (@eSr^eXc-ssj-) also!
(13:20:58) (@eSr^eXc-ssj-) nir! got a new virus
(13:21:01) (@eSr^eXc-ssj-) and formated or fixed it
(13:21:02) (@eSr^eXc-Tibby) wthell
(13:21:06) (@eSr^eXc-ssj-) aval ezel nir ze kavoa
(13:21:10) (@eSr^eXc-ssj-) he will click on anything
(13:21:14) (@eSr^eXc-ssj-) ;/
How did ^power clean himself of the virus?
(13:46:41) (@^power) (13:20:58) (@eSr^eXc-ssj-) nir! got a new virus
(13:46:42) (@^power) (13:21:06) (@eSr^eXc-ssj-) aval ezel nir ze kavoa
(13:46:51) (@^power) Bona Aviad ani itba otcha al hotsaat diba!
(13:47:39) (@^power) This is the first time I hit something like that in my comp.
(13:47:47) (@^power) And it wasn’t malicious at all.
(13:48:05) (@^power) Just started a process and added it to Run/RunOnce.
(13:48:35) (@^power) ;(
^power’s virus didn’t have anything to do with Q auths and takeovers. Just a noob non-malicious worm.
Few days later, Raistlin pastes the following
(06:49:31) (@eSr^eXc-Raist) haha
(06:49:32) (@eSr^eXc-Raist) kabel
(06:49:32) (@eSr^eXc-Raist) [05:45:22] <+[X]PainZ> seen this? http://private.a123sdsdssddddgfg.com
(06:49:33) (@eSr^eXc-Raist) [05:47:48] *** KuSi (KuSi@bzq-218-219-32.red.bezeqint.net) Quit (Signed off)
(06:49:35) (@eSr^eXc-Raist) [05:52:08] *** gd|off (rozen@iN`Gd.users.quakenet.org) Quit (Read error: Connection reset by peer)
(06:49:36) (@eSr^eXc-Raist) [05:59:08] * hscreaM`bnc is away ((((((Im off, BNC is on))))))
(06:49:38) (@eSr^eXc-Raist) [06:33:50] *** Projection-offz is now known as Projection-Work
(06:49:39) (@eSr^eXc-Raist) [06:45:22] <+[X]PainZ> omg!! http://private.a123sdsdssddddgfg.com
(06:49:44) (@eSr^eXc-Raist) :P
(06:49:52) (@eSr^eXc-Raist) [04:45] <+[X]PainZ> http://jokes.clubdepeche.com
(06:49:54) (@eSr^eXc-Raist) and that too
(06:50:03) (@_Paradoxx) :o
(06:50:04) (@eSr^eXc-Raist) NIR DONT CLICK ON THOSE LINKS
(06:50:05) (@eSr^eXc-Raist) :o
This will be a part of my conclusion:
* There were 2 different types of worms/viruses/trojans/whatever you wanna call em, in temp-channel.
1) First was the “people.freenet.de/nathalie/me.jpg” virus which Raistlin was infected with.
– That virus included sending the Q auth to some script kiddie server, and using it to take control of channels you have +m or +n in them or just ban people if you have +o.
– #excession was one of those for Raist and he will always be remembered as the guy who tried to kill that beautiful flower.
– (thank god #temp-channel is password protected and was out of Raistlin’s way of harm.)
2) Second was the “private.a123sdsdssddddgfg.com” virus which ^power was infected with, after clicking Savior’s innocent looking jokes link.
– As seen in the last quote box, the jokes link and the “private.a123” link are the same type of virus.
– The jokes weren’t funny and it was not worth it. When jahova was infected with a .jpg worm, it was atleast funny – tho much more disastrous ^_^
3) Raistlin brought his virus from outside the channel! It will remain like this until proven otherwise.
– The only way for the link to have come from within the channel, is for the log owner (^power) to have pasted it. These worms paste the links and show them to everyone but the guy pasting them.
– However, there are no signs of that anywhere. In addition comes the fact that ^power’s infection came 30 minutes after Raistlin’s infection.
4)

(12:29:46) (@^power) Ronen, because of people like you, these kinds of worms start spreading.
5) Use Mozilla Firefox. You pricks.
6) 9/11 was planned and initiated by the U.S government. Don’t believe anything these guys tell you.
That concludes “What really happend on the temp-channel disaster.”
If you wanna refer to the log by ^power, from March 31st to April 4th, you can grab it right here.
ve kmo she omrim, gg gj and gn.

Leave a Reply

Your email address will not be published. Required fields are marked *