mIRC Home    About    Download    Register    News    Help

Print Thread
Joined: Mar 2003
Posts: 1,271
L
Hoopy frood
OP Offline
Hoopy frood
L
Joined: Mar 2003
Posts: 1,271
The problem is as follows:

there is a file in the C: root called progra, When deleted, it is recreated. I have checked my system thoroughly, and no viruses were found. When I opened the file in notepad, there were 694 lines in it that say

ctcp_catcher($1-)

Now because $1- is an identifier used in mIRC, I was thinking that maybe mIRC is creating this file. I searched my scripts, but nothing was found that could either write to C:\Program, or write the text to the file.

Does anyone here know if this is indeed caused by mIRC, or if it is something else?


DALnet #Helpdesk
I hear and I forget. I see and I remember. I do and I understand. -Confucius
Joined: Mar 2003
Posts: 1,271
L
Hoopy frood
OP Offline
Hoopy frood
L
Joined: Mar 2003
Posts: 1,271
Upgrading the "may not be" to "probably not" -- the two problems have something to do with eachother. If the C:\Program is not there, ACDSee doesn't have a problem. I still wonder tho. I closed a few mIRCs, and restarted them and now it's not coming back. Also Housecall found the virus reported in other threads while other AV scanners didn't.


DALnet #Helpdesk
I hear and I forget. I see and I remember. I do and I understand. -Confucius
Joined: Dec 2002
Posts: 2,985
Hoopy frood
Offline
Hoopy frood
Joined: Dec 2002
Posts: 2,985
Not me.

Joined: Nov 2003
Posts: 2,327
T
Hoopy frood
Offline
Hoopy frood
T
Joined: Nov 2003
Posts: 2,327
housecall doesn't find a virus for me or a few of my friends, maybe it isn't a false positive after all.


New username: hixxy
Joined: Jun 2003
Posts: 5,024
M
Hoopy frood
Offline
Hoopy frood
M
Joined: Jun 2003
Posts: 5,024
I don't get it anymore, but I used to get a security notice telling me a file had been created called C:\Program and that it needs to be renamed to C:\Program1 so that it doesn't effect other programs. I would get several of these, I got up to C:\Program8 eventually.

I too ran several virus/trojan scanners, all coming up clean. I don't know what I did for it to stop happening, but I've been clean from that notice for about a month.

Regards,


Mentality/Chris
Joined: Nov 2003
Posts: 2,327
T
Hoopy frood
Offline
Hoopy frood
T
Joined: Nov 2003
Posts: 2,327
when that happened to me i just noticed it was a script trying to write to $scriptdir without quotes or $shortfn, so it only got to the "c:\program" part of "c:\program files\...."


New username: hixxy
Joined: Jun 2003
Posts: 5,024
M
Hoopy frood
Offline
Hoopy frood
M
Joined: Jun 2003
Posts: 5,024
But would that be affected upon logging on to Windows? (i.e. I hadn't even started mIRC)

Regards,


Mentality/Chris
Joined: Nov 2003
Posts: 2,327
T
Hoopy frood
Offline
Hoopy frood
T
Joined: Nov 2003
Posts: 2,327
if the script writes to c:\program and then you restart your pc, windows will notice the file and prompt you to rename it.


New username: hixxy
Joined: Jun 2003
Posts: 5,024
M
Hoopy frood
Offline
Hoopy frood
M
Joined: Jun 2003
Posts: 5,024
Ohhhh, duh!

Looking back, given that I have unloaded scripts since then and moved folders around etc, that is likely what happened. Kthx <G>

Regards,


Mentality/Chris
Joined: Mar 2003
Posts: 1,271
L
Hoopy frood
OP Offline
Hoopy frood
L
Joined: Mar 2003
Posts: 1,271
Sounds exactly what I had - with the only difference being all my scripts use relative paths, no $scriptdir anywhere... But I'll start combing through my code just to make sure.


DALnet #Helpdesk
I hear and I forget. I see and I remember. I do and I understand. -Confucius
Joined: Feb 2003
Posts: 3,432
S
Hoopy frood
Offline
Hoopy frood
S
Joined: Feb 2003
Posts: 3,432
i had the same problem befor, and my problem was that i had a "copy" in my script.. and everytime that executed it did copy, but it write the stuff it copyed to a file called progra, the right path for it was program files, and my problem was a missing flag in the copy line.. dont know if this helps u tho :tongue:


if ($me != tired) { return } | else { echo -a Get a pot of coffee now $+($me,.) }

Link Copied to Clipboard