Forums General Discussion mIRC virus????

Greetings,

I had mIRC pop-up on my computer during start-up (windows 2000) for the first time a couple of years ago. I emailed Khaled Mardam-Bey about this and he said that the program was an unintended element of a trojan virus, but was unable to help me eliminate it.

Well, here it is a couple of years later and mIRC v5.7 still pops up every time I start my computer. I just discovered this forum and was wondering if anybody out there is familiar with this issue and could HELP me?

The solution is to stop getting infected by practicing basic computer safety. This includes not so much as READING emails sent to you by unknown people, not opening email attachments, not clicking on "free porn" ads, regularly scanning your computer for viruses with an UP TO DATE virus scanner, using a firewall, not visiting websites when you don't know what they are about or for, not running any .exe files on your computer unless they are from a trusted source, not downloading/running warez and keeping the software on your computer up to date.

Please read this thread for more info.

Regards,

Thanks for the advice, Chris. I wish I had been that wise 2 years ago. I have learned the truth of your wisdom since, and am now fully protected.

I have utilized the latest and best tools I can find to remedy the problem on my windows 2000 machine, but no luck so far.

Any idea how I can remove this beasty???

I am reading this: http://www.mirc.co.uk/help/virus.html, now.

Thanks, again Chris...

Success! This was it:

Trojan.IrcBounce - Is your computer infected with a mIRC version 5.7 (as the Help/About/ menu will tell you) hiding as TASKMNGR.EXE (not to be confused with TASKMNG.EXE or TASKMAN.EXE)?

From the load of reports I recieved it seems we have a firm outbreak of this trojan. Trojan.IrcBounce is the detection for a collection of programs that a hacker can use to conceal intrusion and obtain administrator-level access to Microsoft Windows environments. After it is installed into your computer, it gives a remote attacker unobstructed access to your computer. I believe this trojan is used for the DALnet DDoS attacks. The trojan includes a copy of mIRC that hides as Taskmngr.exe actually being mIRC32.exe version 5.7. The Trojan uses this file to run all of its mIRC scripts, including Dll32.hlp, Dll32NT.hlp, Xvpll.hlp, Httpsearch.ini, and NT32.ini.


I removed the TASKMNGR.EXE file from the start up file using Spy Sweeper and then was able to remove all its bits with Norton AntiVirus 2006.

Thanks, Chris...

Just by doing as Mentality said, you can avoid ever having to deal with those things.

And, if you set up a firewall, the trojan wouldn't even have access to the internet as long as you didn't allow the access.