mIRC Home    About    Download    Register    News    Help

Print Thread
Joined: Apr 2003
Posts: 3
J
Self-satisified door
OP Offline
Self-satisified door
J
Joined: Apr 2003
Posts: 3
i follow all of the instructions but i can't uninstall mirc.i don't use norton but i use mcafee. i try to run......regedit/HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and it's not have the file that you say.how can i do for it.if i go to remove program and delete mircat controlpanel/add remove program it say "you must first exit mirc before uninstalling" but i can't exit it. i used window me .help me please. and i never download mirc how it come?i not well in english i'm thai. jimmy_adc@hotmail.com

Joined: Dec 2002
Posts: 843
P
Hoopy frood
Offline
Hoopy frood
P
Joined: Dec 2002
Posts: 843
Read this post. You could also try a very good online virus scanner here as it is better at picking up trojans than some of the other AV programs.


Never compare yourself to others - they're more screwed up than you think.
Joined: Apr 2003
Posts: 3
J
Self-satisified door
OP Offline
Self-satisified door
J
Joined: Apr 2003
Posts: 3
Thank you for your advice the programe that you tell me don't find any virus in my comp. The post that you tell me i try to do before i post my questions yet.But mirc still on my comp.When i right click on the icon of mirc that have 2 icons to exit it,it's exit and a new icon was come again.how can i do for delete it. jimmy_adc@hotmail.com

Joined: Apr 2003
Posts: 3
J
Self-satisified door
OP Offline
Self-satisified door
J
Joined: Apr 2003
Posts: 3
i search for *mirc* and i found it

[mirc]
user=%logo
email=[edit by moderator]
nick=kw
anick=AceHide
host=irc.webchat.orgSERVER:irc.webchat.org:6667

[agent]
enable=0,0,0
char=merlin.acs
options=1,1,1,100,0
speech=150,60,100,1,180,10,50,1,1,1,0,50,1
channel=1,1,1,1,1,1,1,1,1
private=1,1,1,1
other=1,1,1,1,1,1,1
pos=20,20

[windows]
main=318,398,108,291,3,1,0
wchannel=0,112,0,27,0,1,0
wquery=0,112,0,27,1,1,0

[options]
n0=0,1,0,1,0,1,300,0,0,1,1,0,0,0,2,0,0,2,0,0,512,0,0,4,0,0,1,1,0,1,0,1
n1=5,50,0,0,0,0,0,0,0,1,0,0,0,0,1,1,0,0,0,0,1,1,1,0,5,0,0,0,0,0,1,0,0
n2=0,0,0,0,0,1,1,1,0,60,120,0,0,1,0,0,1,0,0,120,20,10,0,0,1,0,0,1,0,0,0
n3=500,0,0,0,0,0,0,1,1,1,0,1,0,0,1,1,1,0,0,1,0,0,0,0,1,0,0,18,0,0,1,3,180
n4=1,0,1,0,0,3,9999,0,0,0,1,0,1024,0,0,1,10,0,0,0,1,1,1,2,1,5000,0,5,0,0,3
n5=1,1,1,1,1,1,1,1,1,1,6667,0,0,0,1,1,1,0,300,10,4,0,1,24,0,0,1,8192,1,0,0,91
n6=0,0,10,1,1,1,0,1,1,1,0,0,0,0,1,0,0,0,0,0,0,0,100,1,1,0,0,1,0,1,4,0
n7=0,0,0,0,0,0,0,0,0,1,0,1,0,1,0,0

[text]
commandchar=/
linesep=-
timestamp=[HH:nn]
accept=*.bmp,*.gif,*.jpg,*.log,*.mid,*.png,*.txt,*.wav,*.zip
ignore=*.exe,*.com,*.bat,*.dll,*.ini,*.mrc,*.vbs,*.js,*.pif,*.scr,*.lnk,*.pl

[files]
servers=servers.ini
browser=c:\progra~1\intern~1\iexplore.exe
emailer=c:\program files\outlook express\msimn.exe
trayicon=x.ico
finger=finger.txt
urls=urls.ini
addrbk=addrbk.ini

[dirs]
logdir=logs\
waves=sounds\
midis=sounds\
mp3s=sounds\

[dde]
ServerStatus=off
ServiceName=mIRC
CheckName=off

[colours]
n0=0,6,4,5,2,3,3,3,3,3,3,1,5,7,6,1,3,2,3,5,1,0,1,0,1,15

[pfiles]
n0=popups.ini
n1=popups.ini
n2=popups.ini
n3=popups.ini
n4=popups.ini

[warn]
fserve=on

[about]
version=5.91
show=imaginary

[local]
local=[moderator edit]
localip=[moderator edit]
longip=[moderator edit]

[notify]
n0=ExploresNOTE:admin
n1=jenneferNOTE:admin
n2=xEviousNOTE:admin
n3=zealandNOTE:admin

[afiles]
n0=aliases.ini

[extensions]
n0=defaultEXTDIR:download\
n1=*.wav,*.mid,*.mp3EXTDIR:sounds\

[rfiles]
n0=remote.ini
n1=remote.ini
n2=botscript.pif

it's in folder c:\windows
bht i delete it every days and it come again every days too

Last edited by ParaBrat; 15/04/03 04:53 AM.
Joined: Jan 2003
Posts: 3,012
Hoopy frood
Offline
Hoopy frood
Joined: Jan 2003
Posts: 3,012
If that file is reappearing, then chances are the "mirc" trojan executable is in C:\Windows\ also. The normal mirc.exe will create that file as a storage place for default settings, and user data. Open C:\Windows. and right click>>organize>>by type and look in the *.exe section.

If you need help detecintg what might be a virus, goto start>>run and type cmd and press enter. Next, in the dos window type cd %WINDIR% and press enter. Next type dir *.exe > C:\dir.txt
and also press enter. now type exit

You should now have the dos window closed. Now goto my computer, and your c drive. Look for "dir.txt" and open it. Then paste the contents here on the forum, and maybe we can help with distinguishing what should/n't be there. grin

Also, Para--Can u censor his ip form the ini, and long ip? Don't want the inocent harmed >:D


-KingTomato
Joined: Apr 2003
Posts: 1
B
Mostly harmless
Offline
Mostly harmless
B
Joined: Apr 2003
Posts: 1
I had the same problem of not being able to uninstall mIRQ. I think it came into my computer on the Trojan.IrcBounce virus which I was able to get rid of but one of the programs the virus consisted of stayed in my computer.

This Trojan consists of the following programs, all of which are detected as Trojan.IrcBounce by Symantec antivirus products:
· Dll32.hlp
· Dll32nt.hlp
· Xvpll.hlp
· Httpsearch.ini
· Nt32.ini
· Gg.bat
· Seced.bat
· Tftp8675
· V.exe
· Mt.exe

This Trojan also uses the following clean programs, which are not detected by Symantec antivirus products:
· Kill.exe
· Mdm.exe
· Mdm.scr
· Ncp.exe
· Psexec.exe
· Taskmngr.exe
I typed all of the above programs into SEARCH and I found one of them in my system. This enabled me to uninstall mIRQ. The one I found was Psexec.exe. Deleting it solved the problem.


Link Copied to Clipboard