mIRC Homepage
Posted By: SkaPunk Uninstalling - 18/01/03 12:40 AM
I am trying to uninstall mIRC from my desktop. The files have all been removed, but mIRC continues to prompt me when powering on or restarting. This is quite annoying. I have read other posts about this issue and followed their advice, (possible trojans and what not) I have run cleaners and the like and still find mIRC wants to start up. Can someone please tell me what to do to get rid of this program? I am a novice and do not know what files may be hidden or where. Any help would be great.
Posted By: Watchdog Re: Uninstalling - 18/01/03 12:58 AM
Use Windows search to try and locate any *mirc* files.
Posted By: Krejt Re: Uninstalling - 18/01/03 09:50 AM
Most probably you have been infected with the Trojan.IrcBounce. This trojan includes a copy of mIRC that hides as Taskmngr.exe (not to be confused with TASKMNG.EXE or TASKMAN.EXE) actually being mIRC32.exe version 5.7. The Trojan uses this file to run all of its mIRC scripts, including Dll32.hlp, Dll32NT.hlp, Xvpll.hlp, Httpsearch.ini, and NT32.ini. Read more, and detailed removal instructions at http://securityresponse.symantec.com/avcenter/venc/data/trojan.ircbounce.html.

Note how this page tells you how the Norton virus scanner will remove the infection itself, but NOT the files in its payload. It will not remove mIRC or the registry setting starting mIRC! You'll have to do this yourself, by hand. The symantec info page provides all info you need to do that.

Carefully read the section "To delete from the registry the value that refers to Taskmngr.exe".
1. In windows, click the Start button, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
4. In the right pane, look for a value or value data that refers to Taskmngr.exe
5. Delete the reference if you find it.
6. Exit the Registry Editor.

Succes!
© mIRC Discussion Forums