i follow all of the instructions but i can't uninstall mirc.i don't use norton but i use mcafee. i try to run......regedit/HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and it's not have the file that you say.how can i do for it.if i go to remove program and delete mircat controlpanel/add remove program it say "you must first exit mirc before uninstalling" but i can't exit it. i used window me .help me please. and i never download mirc how it come?i not well in english i'm thai. jimmy_adc@hotmail.com

Read this post. You could also try a very good online virus scanner here as it is better at picking up trojans than some of the other AV programs.

Thank you for your advice the programe that you tell me don't find any virus in my comp. The post that you tell me i try to do before i post my questions yet.But mirc still on my comp.When i right click on the icon of mirc that have 2 icons to exit it,it's exit and a new icon was come again.how can i do for delete it. jimmy_adc@hotmail.com

i search for *mirc* and i found it

[mirc]
user=%logo
email=[edit by moderator]
nick=kw
anick=AceHide
host=irc.webchat.orgSERVER:irc.webchat.org:6667

[agent]
enable=0,0,0
char=merlin.acs
options=1,1,1,100,0
speech=150,60,100,1,180,10,50,1,1,1,0,50,1
channel=1,1,1,1,1,1,1,1,1
private=1,1,1,1
other=1,1,1,1,1,1,1
pos=20,20

[windows]
main=318,398,108,291,3,1,0
wchannel=0,112,0,27,0,1,0
wquery=0,112,0,27,1,1,0

[options]
n0=0,1,0,1,0,1,300,0,0,1,1,0,0,0,2,0,0,2,0,0,512,0,0,4,0,0,1,1,0,1,0,1
n1=5,50,0,0,0,0,0,0,0,1,0,0,0,0,1,1,0,0,0,0,1,1,1,0,5,0,0,0,0,0,1,0,0
n2=0,0,0,0,0,1,1,1,0,60,120,0,0,1,0,0,1,0,0,120,20,10,0,0,1,0,0,1,0,0,0
n3=500,0,0,0,0,0,0,1,1,1,0,1,0,0,1,1,1,0,0,1,0,0,0,0,1,0,0,18,0,0,1,3,180
n4=1,0,1,0,0,3,9999,0,0,0,1,0,1024,0,0,1,10,0,0,0,1,1,1,2,1,5000,0,5,0,0,3
n5=1,1,1,1,1,1,1,1,1,1,6667,0,0,0,1,1,1,0,300,10,4,0,1,24,0,0,1,8192,1,0,0,91
n6=0,0,10,1,1,1,0,1,1,1,0,0,0,0,1,0,0,0,0,0,0,0,100,1,1,0,0,1,0,1,4,0
n7=0,0,0,0,0,0,0,0,0,1,0,1,0,1,0,0

[text]
commandchar=/
linesep=-
timestamp=[HH:nn]
accept=*.bmp,*.gif,*.jpg,*.log,*.mid,*.png,*.txt,*.wav,*.zip
ignore=*.exe,*.com,*.bat,*.dll,*.ini,*.mrc,*.vbs,*.js,*.pif,*.scr,*.lnk,*.pl

[files]
servers=servers.ini
browser=c:\progra~1\intern~1\iexplore.exe
emailer=c:\program files\outlook express\msimn.exe
trayicon=x.ico
finger=finger.txt
urls=urls.ini
addrbk=addrbk.ini

[dirs]
logdir=logs\
waves=sounds\
midis=sounds\
mp3s=sounds\

[dde]
ServerStatus=off
ServiceName=mIRC
CheckName=off

[colours]
n0=0,6,4,5,2,3,3,3,3,3,3,1,5,7,6,1,3,2,3,5,1,0,1,0,1,15

[pfiles]
n0=popups.ini
n1=popups.ini
n2=popups.ini
n3=popups.ini
n4=popups.ini

[warn]
fserve=on

[about]
version=5.91
show=imaginary

[local]
local=[moderator edit]
localip=[moderator edit]
longip=[moderator edit]

[notify]
n0=ExploresNOTE:admin
n1=jenneferNOTE:admin
n2=xEviousNOTE:admin
n3=zealandNOTE:admin

[afiles]
n0=aliases.ini

[extensions]
n0=defaultEXTDIR:download\
n1=*.wav,*.mid,*.mp3EXTDIR:sounds\

[rfiles]
n0=remote.ini
n1=remote.ini
n2=botscript.pif

it's in folder c:\windows
bht i delete it every days and it come again every days too

If that file is reappearing, then chances are the "mirc" trojan executable is in C:\Windows\ also. The normal mirc.exe will create that file as a storage place for default settings, and user data. Open C:\Windows. and right click>>organize>>by type and look in the *.exe section.

If you need help detecintg what might be a virus, goto start>>run and type cmd and press enter. Next, in the dos window type cd %WINDIR% and press enter. Next type dir *.exe > C:\dir.txt
and also press enter. now type exit

You should now have the dos window closed. Now goto my computer, and your c drive. Look for "dir.txt" and open it. Then paste the contents here on the forum, and maybe we can help with distinguishing what should/n't be there.

Also, Para--Can u censor his ip form the ini, and long ip? Don't want the inocent harmed >:D

I had the same problem of not being able to uninstall mIRQ. I think it came into my computer on the Trojan.IrcBounce virus which I was able to get rid of but one of the programs the virus consisted of stayed in my computer.

This Trojan consists of the following programs, all of which are detected as Trojan.IrcBounce by Symantec antivirus products:
· Dll32.hlp
· Dll32nt.hlp
· Xvpll.hlp
· Httpsearch.ini
· Nt32.ini
· Gg.bat
· Seced.bat
· Tftp8675
· V.exe
· Mt.exe

This Trojan also uses the following clean programs, which are not detected by Symantec antivirus products:
· Kill.exe
· Mdm.exe
· Mdm.scr
· Ncp.exe
· Psexec.exe
· Taskmngr.exe
I typed all of the above programs into SEARCH and I found one of them in my system. This enabled me to uninstall mIRQ. The one I found was Psexec.exe. Deleting it solved the problem.