Update.
i reconstructed what that user done.
first of all created a new file (server.ini NOT serverS.ini)
then he added a new line in mirc.ini section [rfiles] n5=server.ini finally he modified the file "perform.ini" cleaning it up. (maybe even reading it... if so i need to change all my passwords LOL)
hope that helps.
waiting ansiously for answers...
sypher signin off
