So frustrating. I was not able to find an uninstall in either the control panel remove menu nor an uninstall in the mirc folder itself so I deleted it. I installed the new one and the trojan showed again. I My virus protection detected the trojan and removed it (or so it said). I did a spyware scan and it detected the trojan again.
They are all listed as Mirc Script Trojan in Registry keys as follows.
Chat file\defaulticon
Chat file\shell\open\command
Chat file\shell\open\ddeexec
chat file\shell\open\ddeexec\application
chat file\shell\open\ddeexec\ifexec
chat file\shell\open\ddeexec\topic
Software\classes\irc
software\classes\irc\defauticon
software\classes\irc\shell\open\command
software\classes\irc\shell\open\ddeexec
software\classes\irc\shell\open\ddeexec\\application
software\classes\irc\shell\open\ddeexec\topic
software\microsoft\windows\current version\uninstall\mirc\display name
software\microsoft\windows\current version\uninstall\mirc\uninstallstring
I hope that I have that all typed in OK.
Regards, Sylvia
These are all normal registry entries for mIRC, there's nothing sinister in any of them.
You can prevent them from being re-added if you really want, by using the -portable switch. To do that...
- Right-click on the shortcut you use to open mIRC
- Choose "Properties"
- In the "Target box, after the "C:\path to\mirc.exe" text that is already there (don't alter that at all), add {space}-portable (Don't type {space}, just put a space in there so it becomes "C:\path to\mirc.exe" -portable)
- Click "OK"
This makes mIRC avoid all use of the registry.
