Forums mIRC Help Zone Alarm picks up a virus

Well, my friend and I have been using mIRC for a while. Zone alarm would always pick up some sort of virus from mIRC, but I ignored it because it was there since I first got mIRC. Now, our PCs have experienced slow-downs, and crashing (Windows XP Service Pack 2), and have done full system scans. The only virus that showed was the one from mIRC. The way I managed to get it off is to have Zone alarm delete it on reboot, but it removed most mIRC components, including the mIRC executable file. After it was removed, another reboot, and no more slowdowns for me. Did the mIRC components get infected, and if so, how? Also if it helps we were using mIRC v6.21

Picture of Zone Alarm finding it:


Thanks for any help.

Just ignore it, it's not a virus, had the same problem. I disabled the anti-spyware in the firewall, no need since i also run a virus scanned in the background. and i dont think that mirc have anything to do with your "slow-downs", and i must ask, what virus protection do you use along with the firewall? i noticed that Norton realy can mess upp things for the user that have it on hes computer. If you think your computer are infected with something, then go to this page and do a scan. http://www.bitdefender.com/scan8/ie.html

Well, I did a full system scan, and that was the only one that showed up. Could it be possible that it got infected, or there was a virus injected into mIRC's components by an external script?

As that screenshots says, it is "not a virus". The only way mIRC could cause a slowdown is if it's running. If it's not running, it cannot cause any kind of slowdown. Most likely, restarting your computer just helped to clean things up for you.

When was the last time you installed Windows? Windows (any version) works best if it's reinstalled at least every 1-2 years. Failure to do so will cause noticeable performance issues.

There are other viruses and trojans out there that most normal antivirus programs will not detect. That's why you should always run antivirus and regularly scan using at least one anti-spyware program. Running Hijackthis is a good additional step as it checks any possible issues regarding browser hijackers.

Well, this is a rather new installation I'm running it on. Reinstalled just 2 months ago, due to a hardware problem. I did a full system scan, including a system RAM scan. Let me do a scan with the link sparta gave, and if it picks anything else up then I owe you one.

I updated the firewall, after that it noticed mirc and told me it was infected, how ever it was just fine when the firewall was "old", so it's something with the new update for it. Thats what i think since it wasn't any problems befor. So just ignore it.

Well thanks for all the help, it seems there was a virus in the mIRC directory itself. Thanks for the link, sparta

None of the replies explain why the installation file direct from the mIRC download links get flagged as having a virus. Just because its called not-a-virus doesn't mean it isn't.

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT

Scan Target - A file:
C:\mirc63.exe

Scan Statistics:
Total number of scanned objects: 1
Number of viruses found: 1
Number of infected objects: 5
Number of suspicious objects: 0
Duration of the scan process: 00:00:04

Infected Object Name / Virus Name / Last Action
C:\mirc63.exe/stream/data0001/stream/data0014 Infected: not-a-virus:Client-IRC.Win32.mIRC.63 skipped
C:\mirc63.exe/stream/data0001/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.63 skipped
C:\mirc63.exe/stream/data0001 Infected: not-a-virus:Client-IRC.Win32.mIRC.63 skipped
C:\mirc63.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.63 skipped
C:\mirc63.exe NSIS: infected - 4 skipped

Scan process completed.

Just expressing my concern, this doesn't seem to be documented or even discussed here. It doesn't appear in the FAQ and if its really a non-issue it probably should be.

You're asking the the wrong people - you should be asking Kaspersky

It's most likely because mIRC was, and perhaps still is, commonly used as the payload of various viruses (mIRC would be augmented with a malicious script, usually creating a backdoor).

Kaspersky is alerting you to the presence of a possible threat, essentially telling you that if you don't know why it's there it probably shouldn't be.

mIRC comes with no viruses or other malware.

Many antivirus programs and antispyware programs have some kind of section for programs that *might* be dangerous. Kaspersky obviously labels them "not-a-virus". McAfee labels them "possibly unwanted programs" or "PUPs". It's all the same thing. Programs marked as such are programs that *may* be dangerous, but are not dangerous by themselves. Basically, if YOU installed them from a LEGITIMATE source, you're fine. But if they were installed without your consent (part of a bundle or whatever), then they *may* contain some form of virus or trojan or whatever that may be harmful to your computer.

mIRC has a scripting engine that lets you write just about any kind of program you want to. It's possible to have a script that will delete everything on your computer, for example. But mIRC itself doesn't do any such thing and if you only run scripts that you trust, then you don't have to worry about it. Kasperky, McAfee, etc. all warn you that the program is there and may be dangerous if you didn't purposely install it. That's all such things mean.

As mentioned, you can get more information from Kaspersky as to why they chose to label mIRC as "not-a-virus". In the end, mIRC is virus free when downloaded from this site and as long as you don't use scripts that are unsafe or type commands that people you don't trust tell you to type, you have nothing to worry about.

I see, thank you for your detailed post Riamus2.