My mirc posts links to pornsites when I'm on any channel, but I can't see them. I have been kicked from many servers because I have flooded.

Is this a virus? I'm helpless.

Hey there,

It does sound very much like a virus I'm afraid. You need to make sure you don't click on URLs that people send to you, or accept files that others send to you either.

I suggest you scan your computer with several virus/trojan scanners. See this thread for information and resources. You might try download the #NoHack Script because it detects mIRC 'viruses' which use mIRC code to spread, and sometimes, public virus scanners don't detect this as they can't see what's malicious mIRC code and what's not. I do suggest you read all of that post to stay safe in the future

Happy chattin'!

Regards,

It could be a virus, try many of the resources listed in this thread.

You might also want to try typing /!remote off.

I downloaded that #NoHack script thing and it now says that I must type following in the status bar:

//!load -rsn $findfile($shortfn($mircdir),spam.irc,1)

BUT it says "* /load: insufficient parameters". What now?


EDIT: Sorry, I installed those files in the wrong directory :tongue:

Check the #NoHack site again to be sure you did everything right. I'm not 100% familiar with their script but from the syntax and error it looks as if you don't have a file in your mIRC directory (or a sub directory of mIRC). Try placing the files that you got from them in your mIRC directory. You can find this by typing the following command while running mIRC:

//run $mircdir

You can place the files in a sub directory, right click and select "New, New Folder" to create a new location for the files.

"EDIT: Sorry, I installed those files in the wrong directory"

I'm assuming they had already figured it out

Regards,

Yeah, seems he was editing while I was typing. Oh well, glad he figured it out.

I seem to have the same problem, and I cant get rid of it. I tried tons of different virus scans and tried the NoHack script. Also I seem to have the the same problem mentioned in another thread from here, that it wont let me uninstall mirc through add/remove programs (WinXP). Also when I go in to safe mode and uninstall it (that seems to work without problems) then install a fresh copy, then everything seems fine. But after next restart it starts again, and another thing I noticed is it now says Registered to: owned, after that restart. Before restart it just says not registered. I cant seem to find any info on this, and I am running out of things to try. Any help would be great.

Have you tried trojan scanners instead of virus scanners? They work in slightly different ways I believe. Personally, I recommend SwatIT and The Cleaner.

You might try seeking help online from one of the many virus helpers that exist on IRC. There's #NoHack on DALnet, or #VH on Undernet to name just two. You might try typing, for now, /!remote off.

It's registering mIRC with the username 'owned'? That is odd. Just so you know incase you didn't, 'owned' is a word used by stupid people to say that they've been "beaten" or "hacked" etc.. I've never heard of viruses/trojans registering mIRC.

You may also want to check out that thread linked to above and download a firewall. It might help in the future in keeping "hackers" out of your system. That could even be what is happening now, someone may just be continually exploiting your system on an open port. Make sure you have all windows updates from the Windows Update site.

G'luck with your problem

Regards,

I dont think its someone exploiting my system through a port because this seems like a timed thing. After installing a fresh copy of mirc if I dont restart for days it will work without problems. But as soon as I restart or shut it down for the night and turn it back on the next day it seem to re-infect the mirc client. I'll try those trojan scanners also. Thanks.

One of the virus scans detected 2 infected files in windows\system32\secure and windows\system32\rundll32. The weird thing was when I checked those folders both had the same exact contents as my /programfiles/mirc folder. I couldnt find any info on this online so decided to make a system restore point and delete both of those folders. I uninstalled mirc through safe mode and deleted those folders. Restarted pc, everything working fine, installed a new copy of Mirc. Rebooted, and I no longer get the registered by owned msg in help-->about. Also when trying to uninstall it, it does it without the "you must exit mirc before uninstalling" msg that I got before. I'm not sure if this fixed it, but virus scans from different AVs show nothing now, so I hope it did. Any more info on this would be great, thanks.