mIRC Home    About    Download    Register    News    Help

Print Thread
#7108 18/01/03 12:40 AM
Joined: Jan 2003
Posts: 1
S
SkaPunk Offline OP
Mostly harmless
OP Offline
Mostly harmless
S
Joined: Jan 2003
Posts: 1
I am trying to uninstall mIRC from my desktop. The files have all been removed, but mIRC continues to prompt me when powering on or restarting. This is quite annoying. I have read other posts about this issue and followed their advice, (possible trojans and what not) I have run cleaners and the like and still find mIRC wants to start up. Can someone please tell me what to do to get rid of this program? I am a novice and do not know what files may be hidden or where. Any help would be great.

#7109 18/01/03 12:58 AM
Joined: Dec 2002
Posts: 2,985
Hoopy frood
Offline
Hoopy frood
Joined: Dec 2002
Posts: 2,985
Use Windows search to try and locate any *mirc* files.

#7110 18/01/03 09:50 AM
Joined: Dec 2002
Posts: 329
Fjord artisan
Offline
Fjord artisan
Joined: Dec 2002
Posts: 329
Most probably you have been infected with the Trojan.IrcBounce. This trojan includes a copy of mIRC that hides as Taskmngr.exe (not to be confused with TASKMNG.EXE or TASKMAN.EXE) actually being mIRC32.exe version 5.7. The Trojan uses this file to run all of its mIRC scripts, including Dll32.hlp, Dll32NT.hlp, Xvpll.hlp, Httpsearch.ini, and NT32.ini. Read more, and detailed removal instructions at http://securityresponse.symantec.com/avcenter/venc/data/trojan.ircbounce.html.

Note how this page tells you how the Norton virus scanner will remove the infection itself, but NOT the files in its payload. It will not remove mIRC or the registry setting starting mIRC! You'll have to do this yourself, by hand. The symantec info page provides all info you need to do that.

Carefully read the section "To delete from the registry the value that refers to Taskmngr.exe".
1. In windows, click the Start button, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
4. In the right pane, look for a value or value data that refers to Taskmngr.exe
5. Delete the reference if you find it.
6. Exit the Registry Editor.

Succes!


Link Copied to Clipboard