Forums General Discussion /remove is this a bug or a virus?

Every now and then I will look in my status window just to make sure everything is running smoothly. Lately I have looked and seen this " * /remove: no such file 'C:\Documents' '".
It just randomly happens every now and then. I had the custom1.mrc virus a couple days ago. I deleted the file and removed mIRC from my system, rebooted and reinstalled mIRC. Hopefully I got rid of it. Could this be that virus? or is this just a common bug? I am running mIRC v6.14 and the Kog-Fu v2.34 script. What could be causing this problem?

Someone please help!!!

Hi BenniHamA,

The fact that you have removed and reinstalled mIRC would suggest that it is either:
1. The virus still present on your system
2. A problem with your current script

I would suggest you check out the virus/trojan thread on this board and test for the prescence of a virus. If it all turns up clean then try unloading the script and test to see if you still get the error.

It's just a process of elimination really! It's not a bug anyway, that I'm pretty sure of! ( But dont quote me on that! heh! )

Hope that helps!

Regards,
Diz

Run mIRC without the script and see what happens. At this stage I can only assume the script you are using has a destructive feature which is making a bad attempt at deleting "C:\Documents and Settings\" directory. Something which you really do not want deleted.

This is most likely some sort of script file. Viruses don't tend to use /remove, although it's possible (they could be trying to remove valuable files) - most networks have a virus help channel (DALnet - #NoHack, Undernet - #DMsetup) and they know the various commands to help you track the virus.

Personally, I suggest using this thread to detect the latest viruses. The nohack.net guys 'n' gals also suggest using this script to detect some common mIRC infections (that's a direct download).

I would say it's a badly coded script however, as it's trying to use the /remove command but has not used quotes where appropriate so spaces in directory paths are not completed (So if you're trying to access "C:\Documents and Settings" it will only get to "C:\Documents" as is occuring).

It's best to be safe than sorry however - G'luck!

Edit: I think everyone's on pep pills lately, by the time I'd done all those [url links two other posts had been submitted! <G>

Regards,

Well, I removed the script and ran it next to another mIRC client with the script.... I think it is a script problem. When the mIRC client with the script would do " * /remove: no such file 'C:\Documents' " the client without the script would just do nothing. I am still going to run the script. I dont think it could hurt considering the command isn't getting anywhere.

Will notify you all if any other problems arise...

Thank you all


is /remove even a command?

You might like to search for the word 'remove' in all of your script files. This is not as daunting as it may first seem!

Press ALT+R and then press the 'Find Text' button - put in the word 'remove' and look through the script file. When you find something, look at the line it's on and see if you can fix any errors. If you have absolutely no idea then leave it - it's best not to fiddle with something if you don't know what it does! You can go to View in the menubar in the scripts editor and choose a different script file.

And yes, /remove is a command. See /help /remove when in mIRC.

Best of luck!

Regards,

I am still going to run the script. I dont think it could hurt considering the command isn't getting anywhere.

You could be right but I would be double checking it before continued use. I fail to see why a friendly script would want to be deleting that folder and it's an obvious bug in the script that is stopping it chewing away at an important part of Windows. There is also a possibility of other such functions which may work perfectly and delete things you need.

Such is the risk with any script that is not written by the end user.

Scripts written by third parties should only be used if the third party is verified by the community in general as a safe source of good scripts. The same, of course, applies to applications.

I don't think it wants to delete Documents and settings folder, i don't think it can be deleted at all.

/remove c:\Documents and Settings\file_to_be_deleted.txt

* /remove: no such file 'c:\Documents'

It generates that error, no matter if you try to delete a folder or a file in this folder. So i think it's just a badly coded script that keeps something in DaS folder, and doesnt use $shortfn or quotes in remove command.

Edit:

Actually you can't even remove directories using /remove, but /rmdir .

/remove "C:\Documents and Settings\Temp\File to be deleted.txt"
/rmdir "C:\Documents and Settings\Temp\"

If the path or filename has spaces within, double-quote the entire string in any /command you use on them. Identifiers don't require the double-quotes, but usually don't complain, either.

Yes, i know that. The point is that a script tries to remove a file in Documents and Settings, not the directory itself. Obviously there's no quotes in remove command, so it complains about lack of "C:\Documents" file.

Sorry, I just responded to the last post in the thread. I was agreeing with you and giving the command formats for what the script SHOULD have looked like.

in my mp3 system i give the option to delete an mp3, i had the same echo when i forgot to add $shortfn, if the mp3 was in c:\documents and settings\administrator\my documents\my music

there are many reasons why that script could be echoing that message other than just for malicious purposes.

No problem .