Mirc And Webchat.org Problem

[opalhort]

Hi,

my son's PC (XP pro) somehow got the mIRC installed and I can't get rid of it. I did search with google but nothing helps. even editing the registry did not solve it.

mIRC does show in the Add/remove programs but it can't be uninstalled because it is running.

when starting the PC it pops up for 2-3 seconds, to short a time to do anything about it. it does not show in the running processes, services or start-up in msconfig.

at the same time, I'm not sure if this is linked to mIRC, his PC is running full power on the net.

using TcpView I found the destination to be pool.java.webchat.org:6667 and pool.glass.webchat.org:6667

his PC was infected with a trojan and spyware but it has been cleaned now with multiple scans and software, but I can't get rid of the above.

any suggestions?

opalhort

[cdnvic]

There's still something in there.

Install this program (Advanced Windows Care) and run it's startup manager:

http://www.iobit.com/

It will tell you in plain speak which programs are starting at boot, what they are for, and if they're needed. Disable the mIRC ones, and probably many more useless ones you discover are there. After that you should be able to remove the programs after a reboot once you've disabled their ability to sun automatically.

[opalhort]

There's still something in there.

Install this program (Advanced Windows Care) and run it's startup manager:

http://www.iobit.com/

It will tell you in plain speak which programs are starting at boot, what they are for, and if they're needed. Disable the mIRC ones, and probably many more useless ones you discover are there. After that you should be able to remove the programs after a reboot once you've disabled their ability to sun automatically.

Advance Windows Care did not help.

I ran it and cleaned everything (incl. registry) but there is no reference to mIRC (all listed start-up items are known and legit, I recognize them all)

mIRC still starts up and immediately runs on the net to pool.java.webchat.org:6667 and pool.glass.webchat.org:6667

I can only stop the traffic by killing the process in TcpView.

any ideas?

opalhort

[Joost]

I cant tell you what programs to remove if you do not see anything out of the ordinary. I would personally kill the online traffic. Close the used ports.

Are you sure it is Mirc you want to delete and the add/remove doesnt work? I would download and install the latest version of Mirc and remove it. Do it using the add/remove option within XP for installing and removing. Hope this helps

[cdnvic]

Sounds like you may have some clumsy, yet nasty malware that probably tries to launch mirc as a bot. In all honesty I'd say your only real way to make sure the machine is clean now is to reformat and reinstall. We could go through rootkit searches and different antiviruses but you'll probably have far less trouble just starting again from new.

Ubuntu may be a better option for a curious kid.

Edited May 23, 2007 by cdnvic

[opalhort]

Sounds like you may have some clumsy, yet nasty malware that probably tries to launch mirc as a bot. In all honesty I'd say your only real way to make sure the machine is clean now is to reformat and reinstall. We could go through rootkit searches and different antiviruses but you'll probably have far less trouble just starting again from new.

Ubuntu may be a better option for a curious kid.

Thanks for your replies.

I guess a clean start is the best option. Will do that next week since the PC also has a problem with the sound card.

I've been spending now 4 days trying to get rid of this mIRC to no avail.

Whenever my son starts his PC I have to use TcpView to kill the processes, then peace is restored and all works OK.

Question: what is Ubuntu?

opalhort

[opalhort]

mIRC problem solved!

after killing all doubtful processes in TcpView and without re-start went to add/remove programs and finally mIRC did uninstall but left behind many files.

Then I ran the Advance Windows Care which found 7 reg entries in reference to mIRC, had them cleared and restarted (a few times to make sure) and now it is finally gone. I hope for good.

Thanks for all your help

opalhort