I have the BKDR_IRCFLOOD.X malware on my computer too and am unable to connect to Dalnet .. I get akilled with the following message:
[1:38am] * Connecting to powertech.no.eu.dal.net (7000)
-
[1:38am] Local host: homebase (198.77.157.106)
-
[1:38am] ••• You are banned from connecting to this server ("You have been autokilled.")
-
[1:38am] -powertech.no.eu.dal.net- *** You are not welcome on this network.
-
[1:38am] -powertech.no.eu.dal.net- *** autokilled for [AKILL ID:1082727678K-a] [exp/os] Due to abuse from this host, you are no longer welcome on DALnet. See
http://kline.dal.net/exploits/akills.htm#os for more information. (2004/04/23 16.49)
-
[1:38am] -powertech.no.eu.dal.net- *** Your IP is 62.243.15.65
-
[1:38am] -powertech.no.eu.dal.net- *** For assistance, please email
kline@dal.net and include everything shown here.
-
[1:38am] ••• Error: Closing Link: 0.0.0.0 ([AKILL ID:1082727678K-a] [exp/os] Due to abuse from this host, you are no longer welcome on DALnet. See
http://kline.dal.net/exploits/akills.htm#os for more information. (2004/04/23 16.49))
-
[1:38am] * Disconnected
I know that BKDR_IRCFLOOD.X is a dropper program that creates a folder (which I can' find) and creates an autorun registry entry that allows it to execute on every system startup.
It probably comes with mIRC 6.14 somehow and I have no idea how to get rid of it except go to housecall which finds that particualr file but not the rest of the files it drops. So every time I reboot, I have the same problem.
The files it drops are BKDR_IRCFLOOD.X .. BAT_IRCFLOOD.X and IRC_IRCFLOOD.X
It supposedly creates this folder (which I don't have)
C:\%Windows%\Microsoft.NET\Microsoft:NET\Framework\v1.0.3705\
When I do a search for BAT_IRCFLOOD.X the search comes up with 2 files .. lpt$vpn.867 and vptnfile.867 both are in C:\WINNT
I run Windows 2000 server and have no idea what to do.
